CVE-2025-68705 RustFS Path Traversal Vulnerability

What is CVE-2025-68705?

CVE-2025-68705 is a high-severity path traversal vulnerability in rustfs, published on 7 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.78, RustFS contains a path traversal vulnerability in the /rustfs/rpc/read_file_stream endpoint. This issue has been patched in version 1.0.0-alpha.79.

Weakness: CWE-22

Which versions are affected by CVE-2025-68705?

2 open source packages ship an affected version, including rustfs. It affects 1 product.

Products include Rustfs Rustfs.

How do I fix CVE-2025-68705?

Upgrade rustfs to 1.0.0-alpha.79 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-68705 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-68705 exists.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in rustfs

• CVE-2025-68926 RustFS has a gRPC Hardcoded Token Authentication Bypass Critical 9.8
• CVE-2026-27822 Rust has Critical Stored XSS in Preview Modal, leading to Administrative Account Takeover Critical 9.1
• CVE-2026-40937 RustFS: Missing admin authorization on notification target endpoints allows unauthenticated configuration of event webhooks High 8.3
• CVE-2026-27607 RustFS's Missing Post Policy Validation leads to Arbitrary Object Write High 8.1
• CVE-2026-21862 RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headers High 7.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pq29-69jg-9mxc.