PT-2026-1916 · Rustfs · Rustfs

Published 2026-01-07 · Updated 2026-01-07 · CVE-2025-68705

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RustFS versions 1.0.0-alpha.13 through 1.0.0-alpha.78

Description RustFS is a distributed object storage system built in Rust. Versions 1.0.0-alpha.13 through 1.0.0-alpha.78 contain a path traversal vulnerability in the /rustfs/rpc/read file stream API endpoint.

Recommendations Update to version 1.0.0-alpha.79 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-68705

GHSA-PQ29-69JG-9MXC

Affected Products

Rustfs

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68705.json · Exploit
• https://github.com/rustfs/rustfs/security/advisories/GHSA-pq29-69jg-9mxc · Vendor Advisory
• https://github.com/rustfs/rustfs/commit/ab752458ce431c6397175d167beee2ea00507d3e · Patch
• https://osv.dev/vulnerability/GHSA-pq29-69jg-9mxc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68705 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68705 · Security Note
• https://github.com/rustfs/rustfs · Note
• https://twitter.com/VulmonFeeds/status/2009042447175704751 · Twitter Post
• https://twitter.com/CVEnew/status/2009020522462576756 · Twitter Post