Path Traversal Vulnerability in RustFS Distributed Object Storage
CVE-2025-68705

8.8HIGH

Key Information:

Vendor

Rustfs

Status
Rustfs
Vendor
CVE Published:
7 January 2026

What is CVE-2025-68705?

RustFS, a distributed object storage system, is vulnerable to path traversal in versions from 1.0.0-alpha.13 to 1.0.0-alpha.78. The flaw resides in the /rustfs/rpc/read_file_stream endpoint, potentially allowing attackers to access restricted directories or files unintentionally. This vulnerability has been addressed in version 1.0.0-alpha.79, which users are urged to upgrade to in order to enhance system security and protect sensitive data. For further details, refer to the security advisory and associated commit.

Affected Version(s)

rustfs >= 1.0.0-alpha.13, < 1.0.0-alpha.79

References

https://github.com/rustfs/rustfs/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/rustfs/rustfs/commit/ab752458ce431c639...
x_refsource_MISC

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-68705 : Path Traversal Vulnerability in RustFS Distributed Object Storage