RustFS is a Rust‑based distributed object storage system. Between versions 1.0.0‑alpha.56 and 1.0.0‑alpha.82 the implementation of presigned POST uploads (PostObject) fails to validate policy conditions. This omission allows an attacker to ignore content-length-range, starts-with, and Content-Type restrictions, enabling uploads that exceed the intended size, are stored under arbitrary keys, and carry spoofed content types. As a consequence the attacker may exhaust storage resources, retrieve data that should be restricted, or bypass security controls that rely on these policy constraints.

The affected product is RustFS (RustFS rustfs). All releases from 1.0.0‑alpha.56 through 1.0.0‑alpha.82 are vulnerable. Version 1.0.0‑alpha.83 and later contain the fix.

The vulnerability receives a CVSS score of 8.1 (High). EPSS indicates a very low probability of exploitation (<1%) and the issue is not listed in the CISA KEV catalog. The likely attack surface is remote, as the flaw is triggered via any client that can obtain a presigned POST URL. Exploitation requires only knowledge of the presigned URL, which may be widely shared, so the severity remains high despite the low exploitation likelihood.