CVE-2025-68705

Published: Jan 7, 2026Modified: Jan 16, 2026

8.8

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security-advisories@github.com (Secondary)

Description

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.78, RustFS contains a path traversal vulnerability in the /rustfs/rpc/read_file_stream endpoint. This issue has been patched in version 1.0.0-alpha.79.

Affected (66)

Products: Rustfs: Rustfs

Rustfs

1 product

Rustfs

Configuration A

66 vulnerable

Vulnerable Software	Affected Versions
Rustfs Rustfs	Version 1.0.0 alpha13
Rustfs Rustfs	Version 1.0.0 alpha14
Rustfs Rustfs	Version 1.0.0 alpha15
Rustfs Rustfs	Version 1.0.0 alpha16
Rustfs Rustfs	Version 1.0.0 alpha17
Rustfs Rustfs	Version 1.0.0 alpha18
Rustfs Rustfs	Version 1.0.0 alpha19
Rustfs Rustfs	Version 1.0.0 alpha20
Rustfs Rustfs	Version 1.0.0 alpha21
Rustfs Rustfs	Version 1.0.0 alpha22
Rustfs Rustfs	Version 1.0.0 alpha23
Rustfs Rustfs	Version 1.0.0 alpha24
Rustfs Rustfs	Version 1.0.0 alpha25
Rustfs Rustfs	Version 1.0.0 alpha26
Rustfs Rustfs	Version 1.0.0 alpha27
Rustfs Rustfs	Version 1.0.0 alpha28
Rustfs Rustfs	Version 1.0.0 alpha29
Rustfs Rustfs	Version 1.0.0 alpha30
Rustfs Rustfs	Version 1.0.0 alpha31
Rustfs Rustfs	Version 1.0.0 alpha32
Rustfs Rustfs	Version 1.0.0 alpha33
Rustfs Rustfs	Version 1.0.0 alpha34
Rustfs Rustfs	Version 1.0.0 alpha35
Rustfs Rustfs	Version 1.0.0 alpha36
Rustfs Rustfs	Version 1.0.0 alpha37
Rustfs Rustfs	Version 1.0.0 alpha38
Rustfs Rustfs	Version 1.0.0 alpha39
Rustfs Rustfs	Version 1.0.0 alpha40
Rustfs Rustfs	Version 1.0.0 alpha41
Rustfs Rustfs	Version 1.0.0 alpha42
Rustfs Rustfs	Version 1.0.0 alpha43
Rustfs Rustfs	Version 1.0.0 alpha44
Rustfs Rustfs	Version 1.0.0 alpha45
Rustfs Rustfs	Version 1.0.0 alpha46
Rustfs Rustfs	Version 1.0.0 alpha47
Rustfs Rustfs	Version 1.0.0 alpha48
Rustfs Rustfs	Version 1.0.0 alpha49
Rustfs Rustfs	Version 1.0.0 alpha50
Rustfs Rustfs	Version 1.0.0 alpha51
Rustfs Rustfs	Version 1.0.0 alpha52
Rustfs Rustfs	Version 1.0.0 alpha53
Rustfs Rustfs	Version 1.0.0 alpha54
Rustfs Rustfs	Version 1.0.0 alpha55
Rustfs Rustfs	Version 1.0.0 alpha56
Rustfs Rustfs	Version 1.0.0 alpha57
Rustfs Rustfs	Version 1.0.0 alpha58
Rustfs Rustfs	Version 1.0.0 alpha59
Rustfs Rustfs	Version 1.0.0 alpha60
Rustfs Rustfs	Version 1.0.0 alpha61
Rustfs Rustfs	Version 1.0.0 alpha62
Rustfs Rustfs	Version 1.0.0 alpha63
Rustfs Rustfs	Version 1.0.0 alpha64
Rustfs Rustfs	Version 1.0.0 alpha65
Rustfs Rustfs	Version 1.0.0 alpha66
Rustfs Rustfs	Version 1.0.0 alpha67
Rustfs Rustfs	Version 1.0.0 alpha68
Rustfs Rustfs	Version 1.0.0 alpha69
Rustfs Rustfs	Version 1.0.0 alpha70
Rustfs Rustfs	Version 1.0.0 alpha71
Rustfs Rustfs	Version 1.0.0 alpha72
Rustfs Rustfs	Version 1.0.0 alpha73
Rustfs Rustfs	Version 1.0.0 alpha74
Rustfs Rustfs	Version 1.0.0 alpha75
Rustfs Rustfs	Version 1.0.0 alpha76
Rustfs Rustfs	Version 1.0.0 alpha77
Rustfs Rustfs	Version 1.0.0 alpha78

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (2)

https://github.com/rustfs/rustfs/commit/ab752458ce431c6397175d167beee2ea00507d3e

Source: security-advisories@github.com

Patch

https://github.com/rustfs/rustfs/security/advisories/GHSA-pq29-69jg-9mxc

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.