RustFS Console EUVD-2026-44728

Exploitation requires (1) an account with permission to upload/store an object into a bucket viewable in the console (PR:L authenticated per the CVSS vector), (2) the ability to name that object with a .pdf extension while its bytes are HTML/JavaScript, and (3) a RustFS Console administrator subsequently opening that object in the object preview modal (UI:R - the preview click is the trigger). The specific enabling feature is the extension-based PDF preview path in components/object/preview-modal.tsx / pdf-viewer.tsx that renders any *.pdf key in the PDF viewer regardless of true content type. Limiting factors: only versions 0.1.7-0.1.9 are affected, the attacker must be able to place a file where an admin will preview it, and successful credential theft depends on an admin actually using the preview feature - automated exploitation without that human step is not possible.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, base 9.0) reflects a network-reachable, low-complexity attack that requires some privilege (PR:L - an authenticated account able to upload objects) and victim interaction (UI:R - an admin must open the preview), with a scope change (S:C) because script executing in the admin's browser can steal the admin's storage credentials and thereby compromise the wider storage system. No EPSS score, KEV entry, POC, or SSVC decision data was provided. There is no public exploit identified at time of analysis and it is not in CISA KEV, so this is a real but not confirmed-in-the-wild priority; the high base score is driven largely by the scope change and credential-exposure impact rather than by trivially remote-unauthenticated access. The PR:L/UI:R requirements meaningfully lower real-world exploitability versus a pure unauthenticated RCE. Note the reliance on admin credential theft is what justifies the C:H/I:H/A:H rating; treat availability impact as inferred rather than vendor-stated.

An attacker with an account permitted to upload objects stores a file named report.pdf whose contents are actually HTML with an embedded script. When a RustFS administrator opens that object in the console's preview modal, the extension-based logic routes it to the PDF viewer, the script runs in the console origin, and it harvests the admin's AccessKeyId, SecretAccessKey, and SessionToken. No public POC was provided, but the vulnerable and fixed code paths are visible in the public commit.