Rejetto HFS
CVE-2026-61501
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
No privileges needed to inject; scope changes because XSS fires in admin browser enabling server code execution, warranting I:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Rejetto HFS 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote unauthenticated attacker can submit a failed login with a crafted username that is written to the error log and executes JavaScript in an administrator's browser when the logs are viewed, allowing the attacker to create accounts or execute code on the server with the administrator's privileges.
AnalysisAI
Stored cross-site scripting in Rejetto HTTP File Server 3.0.0-3.2.0 allows an unauthenticated remote attacker to inject persistent JavaScript into the server error log via a crafted username in a failed login attempt. When an administrator views the log panel, the payload executes in their browser session, granting the attacker the ability to create accounts or execute server-side code with full administrative privileges. No public exploit has been identified at time of analysis, but the attack chain is low-complexity and the vendor has confirmed a fix in v3.2.1.
Technical ContextAI
Rejetto HFS (HTTP File Server) is a lightweight Windows-based file-sharing application. The affected scope (CPE: cpe:2.3:a:rejetto:hfs:*:*:*:*:*:*:*:*) covers all 3.x releases from 3.0.0 through 3.2.0. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the administration panel's log viewer renders log entries as raw HTML rather than escaping or sanitizing them, allowing attacker-controlled content supplied in the username field of a failed login to be persisted as executable script. Because the log viewer runs inside an authenticated administrator session, the injected JavaScript executes with the full privilege context of that session, enabling secondary impacts - account creation and server-side code execution - that substantially exceed the direct XSS impact.
RemediationAI
Upgrade Rejetto HFS to version 3.2.1 immediately; this is the vendor-confirmed patched release addressing CVE-2026-61501 along with additional co-disclosed security issues, available at https://github.com/rejetto/hfs/releases/tag/v3.2.1. If an immediate upgrade is operationally blocked, restrict access to the HFS administration panel to a trusted IP allowlist via host-based firewall or network segmentation - this prevents both injection of new payloads and prevents any existing log payloads from being triggered by unauthorized administrators. As a secondary control, disable the public-facing login endpoint if unauthenticated user access is not required for the deployment; this eliminates the injection vector entirely at the cost of removing self-service login for legitimate users. Note that purging existing logs will remove any staged payloads but does not fix the underlying rendering flaw and does not protect against re-injection.
Administrator session forgery in Rejetto HFS (HTTP File Server) versions 3.0.0 through 3.2.0 lets a remote unauthenticat
Path traversal via the `lang` query parameter in Rejetto HFS 3.0.0 through 3.2.0 enables remote unauthenticated attacker
Username enumeration in Rejetto HFS 3.0.0-3.2.0 exposes valid account names-including the default admin account-to remot
Rejetto HTTP File Server (HFS) versions 3.0.0 through 3.2.0 performs state-changing administrative operations via HTTP G
Stored XSS in Rejetto HFS 3.0.0 through 3.2.0 allows attackers with upload access - or any user on servers configured wi
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today