RustFS Console versions >=0.1.7 and <0.1.10 contain a stored cross-site scripting vulnerability due to improper neutralization of input in the components/object/preview-modal.tsx and components/object/pdf-viewer.tsx files. Specifically, the PDF preview feature can render HTML content embedded in .pdf files, enabling attackers to execute arbitrary scripts within the management console context. This leads to potential disclosure of administrator credentials including AccessKeyId, SecretAccessKey, and SessionToken. The vulnerability is a regression of CVE-2026-27822 and is resolved in version 0.1.10.

Exploitation of this vulnerability allows an attacker to execute arbitrary scripts in the context of the RustFS Console management interface. This can result in full compromise of administrator credentials, including AccessKeyId, SecretAccessKey, and SessionToken, potentially leading to unauthorized access and control over the RustFS distributed file system environment. The CVSS v3.1 score of 9.0 reflects high attack vector accessibility (network), low attack complexity, required privileges (low), user interaction (required), and high impact on confidentiality, integrity, and availability.

Upgrade RustFS Console to version 0.1.10 or later, where this vulnerability is fixed. There is no indication of an official patch or temporary workaround other than updating to the fixed version. Users should verify they are not running affected versions (>=0.1.7 and <0.1.10) and apply the update promptly to prevent exploitation.