{"id":"CVE-2026-49991","aliases":["EUVD-2026-39865","GHSA-f4vq-9ffr-m8m3"],"status":"published","title":"RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection","description":"RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely breaking multi-tenant isolation. The vulnerability chains three flaws: No ../ sanitization in tar entry key normalization; IAM wildcard matching uses raw (uncleaned) paths; and Filesystem path cleaning resolves ../ across bucket boundaries.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00415,"percentile":0.36131,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22","CWE-862"],"published":"2026-06-26T20:01:29Z","modified":"2026-10-28T02:31:15Z","products":[{"vendor":"rustfs","product":"rustfs"}],"references":[{"url":"https://github.com/rustfs/rustfs/security/advisories/GHSA-f4vq-9ffr-m8m3","tags":["x_refsource_CONFIRM","exploit","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49991.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49991","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-49991","title":"RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection","description":"RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely breaking multi-tenant isolation. The vulnerability chains three flaws: No ../ sanitization in tar entry key normalization; IAM wildcard matching uses raw (uncleaned) paths; and Filesystem path cleaning resolves ../ across bucket boundaries.","status":"published","published":"2026-06-26T20:01:29.896Z","modified":"2026-06-29T13:15:10.741Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-22","CWE-862"],"updated_at":"2026-11-02T13:35:10.963527Z"}],"euvd":[{"id":"EUVD-2026-39865","description":"RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely breaking multi-tenant isolation. The vulnerability chains three flaws: No ../ sanitization in tar entry key normalization; IAM wildcard matching uses raw (uncleaned) paths; and Filesystem path cleaning resolves ../ across bucket boundaries.","status":"published","published":"2026-06-26T20:01:29Z","modified":"2026-06-29T13:15:10Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:20:22.87152Z"}],"nvd":[{"id":"CVE-2026-49991","description":"RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely breaking multi-tenant isolation. The vulnerability chains three flaws: No ../ sanitization in tar entry key normalization; IAM wildcard matching uses raw (uncleaned) paths; and Filesystem path cleaning resolves ../ across bucket boundaries.","status":"published","published":"2026-06-26T20:17:17.817Z","modified":"2026-06-29T14:16:55.58Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22","CWE-862"],"updated_at":"2026-11-02T14:12:26.508751Z"}],"osv":[{"id":"CVE-2026-49991","title":"RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection","description":"RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely breaking multi-tenant isolation. The vulnerability chains three flaws: No ../ sanitization in tar entry key normalization; IAM wildcard matching uses raw (uncleaned) paths; and Filesystem path cleaning resolves ../ across bucket boundaries.","status":"published","published":"2026-06-26T20:01:29.896Z","modified":"2026-10-28T02:31:15.098750569Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-22","CWE-862"],"updated_at":"2026-11-02T15:45:07.060148Z"}]}}