CVE-2026-62378

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-62378", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-13T22:04:59.678Z", "datePublished": "2026-07-15T16:50:13.127Z", "dateUpdated": "2026-07-16T19:19:40.699Z"}, "containers": {"cna": {"title": "RustFS Console: Critical Stored XSS in Preview Modal leading to Administrative Account Takeover", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/rustfs/rustfs/security/advisories/GHSA-7gcx-wg4x-q9x6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rustfs/rustfs/security/advisories/GHSA-7gcx-wg4x-q9x6"}, {"name": "https://github.com/rustfs/console/commit/49630dc140e6818aaee8879ade038a129838a2f2", "tags": ["x_refsource_MISC"], "url": "https://github.com/rustfs/console/commit/49630dc140e6818aaee8879ade038a129838a2f2"}, {"name": "https://github.com/rustfs/console/releases/tag/v0.1.10", "tags": ["x_refsource_MISC"], "url": "https://github.com/rustfs/console/releases/tag/v0.1.10"}], "affected": [{"vendor": "rustfs", "product": "console", "versions": [{"version": ">= 0.1.7, < 0.1.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-15T16:50:13.127Z"}, "descriptions": [{"lang": "en", "value": "RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS Console components/object/preview-modal.tsx and components/object/pdf-viewer.tsx extension-based PDF preview path can render HTML content uploaded as .pdf, allowing stored cross-site scripting in the management console and exposure of administrator AccessKeyId, SecretAccessKey, and SessionToken values. This is caused by a regression of CVE-2026-27822. This vulnerability is fixed in 0.1.10."}], "source": {"advisory": "GHSA-7gcx-wg4x-q9x6", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/rustfs/rustfs/security/advisories/GHSA-7gcx-wg4x-q9x6", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-16T19:19:26.769532Z", "id": "CVE-2026-62378", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-16T19:19:40.699Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-62378", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-16T19:19:26.769532Z"}}}], "references": [{"url": "https://github.com/rustfs/rustfs/security/advisories/GHSA-7gcx-wg4x-q9x6", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-16T19:19:09.987Z"}}], "cna": {"title": "RustFS Console: Critical Stored XSS in Preview Modal leading to Administrative Account Takeover", "source": {"advisory": "GHSA-7gcx-wg4x-q9x6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "rustfs", "product": "console", "versions": [{"status": "affected", "version": ">= 0.1.7, < 0.1.10"}]}], "references": [{"url": "https://github.com/rustfs/rustfs/security/advisories/GHSA-7gcx-wg4x-q9x6", "name": "https://github.com/rustfs/rustfs/security/advisories/GHSA-7gcx-wg4x-q9x6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/rustfs/console/commit/49630dc140e6818aaee8879ade038a129838a2f2", "name": "https://github.com/rustfs/console/commit/49630dc140e6818aaee8879ade038a129838a2f2", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rustfs/console/releases/tag/v0.1.10", "name": "https://github.com/rustfs/console/releases/tag/v0.1.10", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS Console components/object/preview-modal.tsx and components/object/pdf-viewer.tsx extension-based PDF preview path can render HTML content uploaded as .pdf, allowing stored cross-site scripting in the management console and exposure of administrator AccessKeyId, SecretAccessKey, and SessionToken values. This is caused by a regression of CVE-2026-27822. This vulnerability is fixed in 0.1.10."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-15T16:50:13.127Z"}}}, "cveMetadata": {"cveId": "CVE-2026-62378", "state": "PUBLISHED", "dateUpdated": "2026-07-16T19:19:40.699Z", "dateReserved": "2026-07-13T22:04:59.678Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-15T16:50:13.127Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "console", "vendor": "rustfs", "versions": [{"status": "affected", "version": ">= 0.1.7, < 0.1.10"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS Console components/object/preview-modal.tsx and components/object/pdf-viewer.tsx extension-based PDF preview path can render HTML content uploaded as .pdf, allowing stored cross-site scripting in the management console and exposure of administrator AccessKeyId, SecretAccessKey, and SessionToken values. This is caused by a regression of CVE-2026-27822. This vulnerability is fixed in 0.1.10."}, {"lang": "es", "value": "RustFS Console es una consola de gesti\u00f3n web para el sistema de archivos distribuido RustFS. Desde 0.1.7 hasta 0.1.10, la ruta de previsualizaci\u00f3n de PDF basada en la extensi\u00f3n de los componentes components/object/preview-modal.tsx y components/object/pdf-viewer.tsx de RustFS Console puede renderizar contenido HTML subido como .pdf, permitiendo cross-site scripting almacenado en la consola de gesti\u00f3n y la exposici\u00f3n de los valores AccessKeyId, SecretAccessKey y SessionToken del administrador. Esto es causado por una regresi\u00f3n de CVE-2026-27822. Esta vulnerabilidad est\u00e1 corregida en 0.1.10."}], "id": "CVE-2026-62378", "lastModified": "2026-10-24T21:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62378", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-16T19:19:26.769532Z", "version": "2.0.3"}}]}, "published": "2026-07-15T17:16:53.020", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/rustfs/console/commit/49630dc140e6818aaee8879ade038a129838a2f2"}, {"source": "security-advisories@github.com", "url": "https://github.com/rustfs/console/releases/tag/v0.1.10"}, {"source": "security-advisories@github.com", "url": "https://github.com/rustfs/rustfs/security/advisories/GHSA-7gcx-wg4x-q9x6"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/rustfs/rustfs/security/advisories/GHSA-7gcx-wg4x-q9x6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.1.7,0.1.10)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "console", "source": "cna", "vendor": "rustfs"}, "product": "console", "vendor": "rustfs"}], "created": "2026-07-17T16:30:17.350549+00:00", "updated": "2026-07-31T03:30:18.056308+00:00", "vendors": ["rustfs", "rustfs$PRODUCT$console"]}