Path Traversal Vulnerability in RustFS Object Storage by Rust

CVE-2026-49991

What is CVE-2026-49991?

RustFS, a distributed object storage system developed in Rust, is compromised by a path traversal vulnerability in version 1.0.0-beta.4. This flaw allows authenticated users with only PutObject permissions on their own storage buckets to exploit the Snowball auto-extract feature. By taking advantage of this vulnerability, attackers can write arbitrary objects into other users' buckets, breaking the fundamental multi-tenant isolation of the system. The issue arises from a combination of three flaws: the absence of proper ../ sanitization in tar entry key normalization, raw path handling in IAM wildcard matching, and insufficient filesystem path cleansing that allows resolution of ../ across bucket boundaries.

References