Is there a patch available for CVE-2026-61502?

Yes, a patch is available for CVE-2026-61502. Update the affected software to the latest version immediately.

Rejetto HFS CVE-2026-61502

Q: What is the CVSS score of CVE-2026-61502?

CVE-2026-61502 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-13 VulnCheck

RCE CSRF Hfs Rejetto

5.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.3 CRITICAL

Network-delivered CSRF with no attacker privileges; scope changes because admin compromise yields RCE, giving high C and I beyond the original session.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 13, 2026 - 19:43 vuln.today

Analysis Generated

Jul 13, 2026 - 19:43 vuln.today

DescriptionCVE.org

Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution - by causing a logged-in administrator's browser to navigate to a crafted URL, or without any credentials against default installations when the attack originates from the server's own machine.

AnalysisAI

Rejetto HTTP File Server (HFS) versions 3.0.0 through 3.2.0 performs state-changing administrative operations via HTTP GET requests while exempting GET from its anti-CSRF header validation, enabling two distinct attack paths: a classic CSRF attack requiring a logged-in administrator to visit a crafted URL, and a fully unauthenticated path exploitable from localhost against default installations. Successful exploitation allows account creation, configuration modification, and ultimately remote code execution on the HFS host. Patch version 3.2.1 is available; no public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Rejetto HFS is a lightweight, self-contained HTTP File Server targeting personal and small-team use cases, identified by CPE cpe:2.3:a:rejetto:hfs:*:*:*:*:*:*:*:*. The root cause is CWE-352 (Cross-Site Request Forgery): HFS exposes administrative API endpoints that accept state-mutating operations over GET rather than restricting them to POST/PUT/DELETE. Browsers and HTTP clients will follow GET URLs freely - via img tags, iframes, or redirects - without triggering CORS preflight or SameSite cookie protections that might otherwise apply to POST. HFS's own CSRF mitigation (an anti-CSRF header check) is only applied to non-GET methods, so the GET-based state-change endpoints are entirely unprotected. A secondary design issue exists in default installations: the server apparently grants elevated trust to requests originating from the loopback interface (127.0.0.1), bypassing authentication for those requests.

RemediationAI

Upgrade to Rejetto HFS 3.2.1 immediately, available at https://github.com/rejetto/hfs/releases/tag/v3.2.1; the vendor release notes confirm this version addresses multiple security vulnerabilities including this CSRF flaw. If immediate upgrade is not possible, restrict network access to the HFS management interface to trusted IPs only using a host-based firewall or reverse proxy ACL, which mitigates the CSRF vector by preventing untrusted clients from reaching the endpoint - note this does not fully address the localhost vector. As a compensating control for the localhost unauthenticated path, disable any co-located SSRF-capable services or scripting features that could initiate HTTP requests to 127.0.0.1. Ensure HFS is not exposed on publicly routable interfaces without authentication enforcement at a network boundary.