Rejetto HFS
CVE-2026-61503
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable login endpoint requires no authentication or user interaction; impact is strictly limited confidentiality loss (username enumeration) with no integrity, availability, or scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticated attacker can use this to confirm valid account names, including the default admin account, facilitating password-guessing and session-forgery attacks.
AnalysisAI
Username enumeration in Rejetto HFS 3.0.0-3.2.0 exposes valid account names-including the default admin account-to remote unauthenticated attackers through observably different login endpoint responses (CWE-204). The vendor release notes for v3.2.1 indicate this is one of multiple related vulnerabilities that collectively could allow an attacker to gain administrative access, suggesting this flaw may serve as a reconnaissance enabler in a broader attack chain. No public exploit is identified at time of analysis; vendor-released patch v3.2.1 is available.
Technical ContextAI
Rejetto HFS (HTTP File Server) is a lightweight, self-hosted web-based file-sharing server. The login endpoint exhibits an observable response discrepancy (CWE-204): it returns detectably different HTTP responses-differing status codes, body content, or timing-depending on whether a submitted username exists in the system. This is a classic authentication-layer information disclosure pattern. The CPE cpe:2.3:a:rejetto:hfs:*:*:*:*:*:*:*:* covers all platform variants of HFS versions 3.0.0 through 3.2.0. Critically, the vendor release notes for v3.2.1 explicitly describe multiple co-remediated vulnerabilities capable of enabling administrative compromise, positioning this enumeration flaw as a likely reconnaissance precursor rather than an isolated, low-impact finding.
RemediationAI
Upgrade to Rejetto HFS version 3.2.1 immediately; this release is confirmed by the vendor at https://github.com/rejetto/hfs/releases/tag/v3.2.1 and addresses this flaw alongside additional vulnerabilities that collectively enable administrative compromise. If upgrade is not immediately possible, restrict network access to the HFS login endpoint to trusted IP ranges using firewall rules or a reverse proxy, accepting the trade-off of reduced remote accessibility for legitimate users. Additionally, enforce strong unique passwords on all HFS accounts-especially the default admin account-and configure login rate-limiting or account lockout if supported, as these controls reduce the practical value of username enumeration without eliminating the underlying flaw. Do not rely on compensating controls as a permanent substitute for the patch.
Administrator session forgery in Rejetto HFS (HTTP File Server) versions 3.0.0 through 3.2.0 lets a remote unauthenticat
Path traversal via the `lang` query parameter in Rejetto HFS 3.0.0 through 3.2.0 enables remote unauthenticated attacker
Stored cross-site scripting in Rejetto HTTP File Server 3.0.0-3.2.0 allows an unauthenticated remote attacker to inject
Rejetto HTTP File Server (HFS) versions 3.0.0 through 3.2.0 performs state-changing administrative operations via HTTP G
Stored XSS in Rejetto HFS 3.0.0 through 3.2.0 allows attackers with upload access - or any user on servers configured wi
Same weakness CWE-204 – Observable Response Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today