The flaw arises from the Snowball auto‑extract feature, where tar entries containing "../" are not cleaned before normalization. An authenticated user who can upload a tar archive can trick the system into writing objects into any bucket, including those owned by other users. This allows the attacker to overwrite, delete, or replace objects belonging to other tenants, thereby breaking multi‑tenant isolation and potentially exposing or corrupting sensitive data.

RustFS distributed object storage system, version 1.0.0‑beta.4. The vulnerability is present only in this release; later releases include the fix.

The CVSS score is 8.6, indicating a high severity. The exploit requires authenticated PutObject access and the ability to trigger the Snowball auto‑extract process. An attacker can craft a tar archive that contains directory traversal entries; because the system processes these entries without sanitization, the attacker can write arbitrary objects to buckets of other users. Although the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the combination of authentication requirements and the ease of exploitation via the auto‑extract flow suggests that a realistic attacker could achieve significant damage.