{"action":"Upgrade rustfs to 1.0.0-alpha.83 or later.","affected":[{"fixed":"1.0.0-alpha.83","introduced":"1.0.0-alpha.56"}],"component":"rustfs","cve_ids":["CVE-2026-27607"],"ecosystem":"crates.io","epss":0.00369,"exploited":false,"fixed_versions":["1.0.0-alpha.83"],"ghsa_id":"GHSA-w5fh-f8xh-5x3p","id":"tcs_01M5KF3WA9KTEC1C9WJYXW8XTR","modified_at":"2026-02-25T22:47:39.717003Z","published_at":"2026-02-25T22:38:40Z","references":["https://osv.dev/vulnerability/GHSA-w5fh-f8xh-5x3p","https://github.com/rustfs/rustfs/security/advisories/GHSA-w5fh-f8xh-5x3p","https://nvd.nist.gov/vuln/detail/CVE-2026-27607","https://github.com/rustfs/rustfs","https://github.com/rustfs/rustfs/releases/tag/1.0.0-alpha.83"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-w5fh-f8xh-5x3p","url":"https://osv.dev/vulnerability/GHSA-w5fh-f8xh-5x3p"}],"summary":"RustFS: Missing Post Policy Validation leads to Arbitrary Object Write"}