Rejetto Http File Server
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Rejetto Http File Server.
By the Year
In 2026 there have been 6 vulnerabilities in Rejetto Http File Server with an average score of 6.4 out of ten. Http File Server did not have any published security vulnerabilities last year. That is, 6 more vulnerabilities have already been reported in 2026 as compared to last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 6 | 6.43 |
| 2025 | 0 | 0.00 |
| 2024 | 2 | 9.30 |
| 2023 | 0 | 0.00 |
| 2022 | 0 | 0.00 |
| 2021 | 0 | 0.00 |
| 2020 | 1 | 7.50 |
It may take a day or so for new Http File Server vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Rejetto Http File Server Security Vulnerabilities
Rejetto HFS <=3.2.0 Path Traversal via lang Parameter
CVE-2026-61505
6.9 - Medium
- July 13, 2026
Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthenticated attacker to read certain JSON files outside the shared folders. Exploitation is constrained to files matching a narrow naming and format pattern, limiting practical impact.
Directory traversal
Rejetto HFS 3.0.0-3.2.0 Directory Listing XSS via ?get=basic
CVE-2026-61504
5.1 - Medium
- July 13, 2026
Rejetto HFS 3.0.0 through 3.2.0 does not escape file names in its fallback "basic" web listing, and this listing can be forced by any browser via the ?get=basic parameter. A user with upload permission - or an anonymous user on servers with an open upload folder - can store a file whose name contains script that executes in the browser of anyone viewing the listing.
XSS
Rejetto HFS 3.0.0-3.2.0 Login Endpoint Username Enumeration
CVE-2026-61503
6.9 - Medium
- July 13, 2026
Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticated attacker can use this to confirm valid account names, including the default admin account, facilitating password-guessing and session-forgery attacks.
Observable Response Discrepancy
Rejetto HFS 3.0-3.2 GET CSRF Enables Privilege Escalation
CVE-2026-61502
5.1 - Medium
- July 13, 2026
Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution - by causing a logged-in administrator's browser to navigate to a crafted URL, or without any credentials against default installations when the attack originates from the server's own machine.
Session Riding
Rejetto HFS 3.0.0-3.2.0 Log XSS via Unescaped Username
CVE-2026-61501
5.3 - Medium
- July 13, 2026
Rejetto HFS 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote unauthenticated attacker can submit a failed login with a crafted username that is written to the error log and executes JavaScript in an administrator's browser when the logs are viewed, allowing the attacker to create accounts or execute code on the server with the administrator's privileges.
XSS
Rejetto HFS 3.0.0-3.2.0: Math.random() Key Leakage Admin Session Forgery
CVE-2026-61500
9.3 - Critical
- July 13, 2026
Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature.
PRNG
Rejetto HFS 3 <0.52.10: Remote Auth Upload OS Command Exec (Node.js)
CVE-2024-39943
8.8 - High
- July 04, 2024
rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).
Shell injection
Remote Template Injection in Rejetto HFS 2.3m (Arbitrary CMD Exec)
CVE-2024-23692
9.8 - Critical
- May 31, 2024
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.
1336
rejetto HFS (aka HTTP File Server) v2.3m Build #300, when virtual files or folders are used
CVE-2020-13432
7.5 - High
- June 08, 2020
rejetto HFS (aka HTTP File Server) v2.3m Build #300, when virtual files or folders are used, allows remote attackers to trigger an invalid-pointer write access violation via concurrent HTTP requests with a long URI or long HTTP headers.
Classic Buffer Overflow
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c
CVE-2014-6287
9.8 - Critical
- October 07, 2014
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.
Code Injection
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Rejetto Http File Server or by Rejetto? Click the Watch button to subscribe.
