CVE-2026-49991: RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection
RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely breaking multi-tenant isolation. The vulnerability chains three flaws: No ../ sanitization in tar entry key normalization; IAM wildcard matching uses raw (uncleaned) paths; and Filesystem path cleaning resolves ../ across bucket boundaries.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49991?
CVE-2026-49991 has a severity score of 8.6, categorized as high.
How do I fix CVE-2026-49991?
To fix CVE-2026-49991, ensure that users have appropriate permissions and apply the latest patches to RustFS Snowball auto-extract.
What are the implications of CVE-2026-49991?
CVE-2026-49991 allows authenticated users to exploit a path traversal vulnerability and write arbitrary objects into other users' buckets.
Who is affected by CVE-2026-49991?
CVE-2026-49991 affects users of RustFS Snowball auto-extract feature who have PutObject permissions in their own buckets.
When was CVE-2026-49991 published?
CVE-2026-49991 was published on June 26, 2026.