Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 9

Export CSV
CVE-2026-61505

Rejetto HFS < 3.2.1 Limited File Disclosure via Path Traversal in lang Parameter

Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthenticated attacker to read certain JSON files outside the shared folders. Exploitation is constrained to files matching a narrow naming and format pattern, limiting practical impact.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Rejetto
Products
Hfs Http File Server
CVE-2026-61504

Rejetto HFS < 3.2.1 Stored XSS via File Names in Basic Web Listing

Rejetto HFS 3.0.0 through 3.2.0 does not escape file names in its fallback "basic" web listing, and this listing can be forced by any browser via the ?get=basic parameter. A user with upload permission - or an anonymous user on servers with an open upload folder - can store a file whose name contains script that executes in the browser of anyone viewing the listing.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Rejetto
Products
Hfs Http File Server
CVE-2026-61503

Rejetto HFS < 3.2.1 Username Enumeration via Login Response Differences

Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticated attacker can use this to confirm valid account names, including the default admin account, facilitating password-guessing and session-forgery attacks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Rejetto
Products
Hfs Http File Server
CVE-2026-61502

Rejetto HFS < 3.2.1 Cross-Site Request Forgery via GET Requests

Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution - by causing a logged-in administrator's browser to navigate to a crafted URL, or without any credentials against default installations when the attack originates from the server's own machine.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Rejetto
Products
Hfs Http File Server
CVE-2026-61501

Rejetto HFS < 3.2.1 Stored XSS in Admin Log Viewer

Rejetto HFS 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote unauthenticated attacker can submit a failed login with a crafted username that is written to the error log and executes JavaScript in an administrator's browser when the logs are viewed, allowing the attacker to create accounts or execute code on the server with the administrator's privileges.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Rejetto
Products
Hfs Http File Server
CVE-2026-61500

Rejetto HFS < 3.2.1 Session Forgery via Predictable Signing Key

Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature.

CVSS 4.0 · 9.3 Critical EPSS 1.9% KEV · Not listed
Vendors
Rejetto
Products
Hfs Http File Server
CVE-2026-97359

HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection

HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template quoting sequence followed by an exec macro, which bypasses the authorization check in the dispatcher to execute arbitrary commands on the underlying host system.

CVSS 4.0 · 10 Critical EPSS 5.5% KEV · Not listed
Vendors
Rejetto
Products
Hfs2
CVE-2026-97360

HFS2 2.4.0 Unauthenticated Arbitrary File Read/Write via Template Engine

HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside the shared folder. Attackers can exploit the macro dispatcher's lack of authorization model combined with the path resolver's failure to confine absolute paths to manipulate the template engine and compromise the confidentiality, integrity, and availability of the host.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Rejetto
Products
Hfs2
CVE-2026-97362

HFS2 2.4.0 Unauthenticated Denial of Service via Hung Serving Thread

HFS2 version 2.4.0 and earlier contains a denial of service vulnerability that allows unauthenticated attackers to cause a complete and persistent loss of availability by sending a single crafted request. Attackers can trigger a hung serving thread that enters a busy loop, rendering the entire file server unresponsive to all clients without self-recovery until an operator manually restarts the service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Rejetto
Products
Hfs2