Rejetto HFS CVE-2026-61501

Exploitation requires two sequential conditions: first, the attacker must reach the HFS login endpoint over the network and submit a failed authentication attempt using a crafted username containing a JavaScript payload - no credentials, prior account, or special configuration are needed for this injection step, as it exploits the standard unauthenticated login flow present in all default HFS 3.x installations. Second, a legitimate HFS administrator must subsequently open the log viewer in the administration panel, which passively triggers the stored payload; without this interaction the payload remains dormant indefinitely. Exploitation is bounded to Rejetto HFS versions 3.0.0-3.2.0 running on the host. The primary limiting factor on real-world risk is the wait for an admin to view the logs - however, log review is a routine administrative activity, not an exceptional one. There are no non-default configuration requirements and no platform restrictions mentioned.

The CVSS 4.0 base score of 5.3 reflects the passive user-interaction requirement (UI:P) - an administrator must view the log before the payload fires - which correctly prevents the score from reaching Critical. However, the provided vector assigns SC:L/SI:L to subsequent-system impact, which appears to materially understate the described outcome: the CVE description explicitly states the attacker can create accounts or execute code on the server with administrator privileges, which warrants SI:H. The attack vector for injection is network-accessible, requires no authentication, and involves no special configuration, making the injection step trivially automated. The only meaningful throttle is the wait for an admin to open the log viewer - a routine operational activity that makes triggering the payload a question of patience rather than sophisticated social engineering. No EPSS score was supplied and this CVE does not appear in CISA KEV, so there is no confirmed in-the-wild exploitation signal. No public proof-of-concept code was identified in the provided data. Overall, operational risk is meaningfully higher than the 5.3 score suggests given the zero-friction injection step and the high-value outcome of administrative code execution.

An attacker submits a failed login to an internet-exposed HFS 3.x instance using a username containing a JavaScript payload - for example, a script that silently calls the HFS API to create a new administrator account using the active session. The entry is written to the error log without sanitization. The next time an HFS administrator opens the log viewer, the payload executes in their browser, creating the backdoor account and returning the credentials to an attacker-controlled endpoint, all without any visible indication to the administrator.