CVE-2026-62378

{
  "id": "CVE-2026-62378",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-15T17:16:53.020",
  "lastModified": "2026-10-24T21:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS Console components/object/preview-modal.tsx and components/object/pdf-viewer.tsx extension-based PDF preview path can render HTML content uploaded as .pdf, allowing stored cross-site scripting in the management console and exposure of administrator AccessKeyId, SecretAccessKey, and SessionToken values. This is caused by a regression of CVE-2026-27822. This vulnerability is fixed in 0.1.10."
    },
    {
      "lang": "es",
      "value": "RustFS Console es una consola de gestión web para el sistema de archivos distribuido RustFS. Desde 0.1.7 hasta 0.1.10, la ruta de previsualización de PDF basada en la extensión de los componentes components/object/preview-modal.tsx y components/object/pdf-viewer.tsx de RustFS Console puede renderizar contenido HTML subido como .pdf, permitiendo cross-site scripting almacenado en la consola de gestión y la exposición de los valores AccessKeyId, SecretAccessKey y SessionToken del administrador. Esto es causado por una regresión de CVE-2026-27822. Esta vulnerabilidad está corregida en 0.1.10."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "rustfs",
          "product": "console",
          "versions": [
            {
              "version": ">= 0.1.7, < 0.1.10",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "baseScore": 9.0,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-16T19:19:26.769532Z",
          "id": "CVE-2026-62378",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/rustfs/console/commit/49630dc140e6818aaee8879ade038a129838a2f2",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/rustfs/console/releases/tag/v0.1.10",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/rustfs/rustfs/security/advisories/GHSA-7gcx-wg4x-q9x6",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/rustfs/rustfs/security/advisories/GHSA-7gcx-wg4x-q9x6",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}