CVE-2025-68705 is a critical path traversal (CVSS 9.8) in RustFS, a distributed object storage system written in Rust. The /rustfs/rpc/read_file_stream endpoint is affected in versions 1.0.0-alpha.13 to 1.0.0-alpha.78. Upgrade every node in the cluster to 1.0.0-alpha.79 or later, and keep the RPC path off untrusted networks.
What's affected
- RustFS 1.0.0-alpha.13 through 1.0.0-alpha.78.
- Fixed version: 1.0.0-alpha.79.
- Affected endpoint: /rustfs/rpc/read_file_stream.
How to check if you're exposed
Check the version of each RustFS node. If you run the binary, use its version flag, and if you run a container, read the image tag. Every node in the cluster needs checking, since this is a distributed system.
Also check whether the RPC endpoint is reachable beyond the cluster network. Node to node traffic should be limited to the cluster, not open to clients.
What to do now
- List all RustFS nodes and their versions.
- Upgrade every node to 1.0.0-alpha.79 or later, following the project's rolling upgrade guidance.
- Block access to the internal RPC path from outside the cluster at the network or proxy layer.
- Review access logs for requests to read_file_stream from addresses that are not cluster members.
- Rotate access keys and secrets stored on nodes if you find unexpected access.
Alpha releases move fast, and fixes often arrive as new alpha numbers rather than patches to older ones. Subscribe to the project's releases and security advisories, and keep a tested path to roll the cluster forward without downtime. That makes the next advisory a routine change, not an emergency.
Why it matters
The weakness is CWE-22, path traversal. An endpoint that streams files accepts a path from the caller and does not keep it inside the intended directory, so a crafted path can reach other files on the node.
The vector shows no authentication and high impact. Storage nodes keep data and often credentials, so reading arbitrary files there is serious. Pre release software, as the alpha label here shows, also changes quickly, which makes tracking releases part of operating it. The record does not list this CVE as exploited in the wild.
Quick check
Which RustFS version fixes CVE-2025-68705?
1.0.0-alpha.79. Versions 1.0.0-alpha.13 to 1.0.0-alpha.78 are affected.
Sources
Last reviewed: 19 October 2026.
