Rejetto

Known Exploited Rejetto Vulnerabilities

The following Rejetto vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Of the known exploited vulnerabilities above, 2 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 9 vulnerabilities in Rejetto with an average score of 7.5 out of ten. Rejetto did not have any published security vulnerabilities last year. That is, 9 more vulnerabilities have already been reported in 2026 as compared to last year.

Recent Rejetto Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-97362	Sep 24, 2026	HFS2 2.4.0 DoS via hung thread loop HFS2 version 2.4.0 and earlier contains a denial of service vulnerability that allows unauthenticated attackers to cause a complete and persistent loss of availability by sending a single crafted request. Attackers can trigger a hung serving thread that enters a busy loop, rendering the entire file server unresponsive to all clients without self-recovery until an operator manually restarts the service.	Hfs2
CVE-2026-97360	Sep 24, 2026	HFS2 2.4.0-: unauthenticated arbitrary file access via macro dispatcher HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside the shared folder. Attackers can exploit the macro dispatcher's lack of authorization model combined with the path resolver's failure to confine absolute paths to manipulate the template engine and compromise the confidentiality, integrity, and availability of the host.	Hfs2
CVE-2026-97359	Sep 24, 2026	HFS2 <2.4.0: Multipart Upload Handler Template Injection Enables RCE HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template quoting sequence followed by an exec macro, which bypasses the authorization check in the dispatcher to execute arbitrary commands on the underlying host system.	Hfs2
CVE-2026-61505	Jul 13, 2026	Rejetto HFS <=3.2.0 Path Traversal via lang Parameter Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthenticated attacker to read certain JSON files outside the shared folders. Exploitation is constrained to files matching a narrow naming and format pattern, limiting practical impact.	Http File Server
CVE-2026-61504	Jul 13, 2026	Rejetto HFS 3.0.0-3.2.0 Directory Listing XSS via ?get=basic Rejetto HFS 3.0.0 through 3.2.0 does not escape file names in its fallback "basic" web listing, and this listing can be forced by any browser via the ?get=basic parameter. A user with upload permission - or an anonymous user on servers with an open upload folder - can store a file whose name contains script that executes in the browser of anyone viewing the listing.	Http File Server
CVE-2026-61503	Jul 13, 2026	Rejetto HFS 3.0.0-3.2.0 Login Endpoint Username Enumeration Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticated attacker can use this to confirm valid account names, including the default admin account, facilitating password-guessing and session-forgery attacks.	Http File Server
CVE-2026-61502	Jul 13, 2026	Rejetto HFS 3.0-3.2 GET CSRF Enables Privilege Escalation Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution - by causing a logged-in administrator's browser to navigate to a crafted URL, or without any credentials against default installations when the attack originates from the server's own machine.	Http File Server
CVE-2026-61501	Jul 13, 2026	Rejetto HFS 3.0.0-3.2.0 Log XSS via Unescaped Username Rejetto HFS 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote unauthenticated attacker can submit a failed login with a crafted username that is written to the error log and executes JavaScript in an administrator's browser when the logs are viewed, allowing the attacker to create accounts or execute code on the server with the administrator's privileges.	Http File Server
CVE-2026-61500	Jul 13, 2026	Rejetto HFS 3.0.0-3.2.0: Math.random() Key Leakage Admin Session Forgery Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature.	Http File Server
CVE-2024-39943	Jul 04, 2024	Rejetto HFS 3 <0.52.10: Remote Auth Upload OS Command Exec (Node.js) rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).	Http File Server