Rejetto HFS
CVE-2026-61504
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable stored XSS needing low-privilege upload access and victim interaction; scope changes to third-party browser sessions with low confidentiality and integrity impact, no availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Rejetto HFS 3.0.0 through 3.2.0 does not escape file names in its fallback "basic" web listing, and this listing can be forced by any browser via the ?get=basic parameter. A user with upload permission - or an anonymous user on servers with an open upload folder - can store a file whose name contains script that executes in the browser of anyone viewing the listing.
AnalysisAI
Stored XSS in Rejetto HFS 3.0.0 through 3.2.0 allows attackers with upload access - or any user on servers configured with publicly writable folders - to inject persistent browser scripts via maliciously named files in the 'basic' web listing mode. Because the basic listing can be forced by any visitor using the ?get=basic URL parameter, the vulnerable rendering path is reachable regardless of whether the default interface is exposed. The vendor's own v3.2.1 release notes state that vulnerabilities addressed in this release collectively enable administrative account compromise; no public exploit or CISA KEV listing has been identified, but a vendor-released patch is available.
Technical ContextAI
Rejetto HFS (HTTP File Server) 3.x is a self-contained, lightweight web-based file server written for personal and small-team use (CPE: cpe:2.3:a:rejetto:hfs). The product includes a fallback 'basic' HTML listing mode intended for compatibility with minimal browsers. CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) applies: the filename, a user-controlled value, is written into HTML context in this code path without HTML-entity escaping. The attack surface is amplified by the fact that any HTTP client can force this rendering path by appending ?get=basic to a directory URL, bypassing whatever protections or UI the default listing may apply. The CVSS 4.0 subsequent-system impact metrics (SC:L/SI:L) confirm the impact is client-side - landing in other users' browser sessions, not on the server process - consistent with a stored, reflected-to-third-parties XSS pattern.
RemediationAI
Upgrade to Rejetto HFS v3.2.1 immediately, as this release addresses this stored XSS and multiple co-reported vulnerabilities that collectively enable administrative access; the patch is available at https://github.com/rejetto/hfs/releases/tag/v3.2.1. If upgrading is not immediately possible, restrict file upload permissions to authenticated, trusted users only - this eliminates the primary injection vector on servers not already configured with open upload folders, though it will disrupt any public file-sharing workflow that depends on anonymous uploads. As an additional layer, deploying a reverse proxy with strict response-header Content-Security-Policy (CSP) rules blocking inline script execution can constrain the impact of any XSS payload reaching a victim browser, though this does not fix the root cause and CSP bypass techniques exist. Blocking or rewriting requests containing the ?get=basic query parameter at the network edge is a targeted workaround that prevents the vulnerable listing mode from being reached, but may break legitimate compatibility use cases. Note that the vendor credits the discovery to Horizon3.ai research in collaboration with Anthropic, and the release bundles fixes for multiple vulnerabilities, making full upgrade strongly preferable over piecemeal mitigations.
Administrator session forgery in Rejetto HFS (HTTP File Server) versions 3.0.0 through 3.2.0 lets a remote unauthenticat
Path traversal via the `lang` query parameter in Rejetto HFS 3.0.0 through 3.2.0 enables remote unauthenticated attacker
Username enumeration in Rejetto HFS 3.0.0-3.2.0 exposes valid account names-including the default admin account-to remot
Stored cross-site scripting in Rejetto HTTP File Server 3.0.0-3.2.0 allows an unauthenticated remote attacker to inject
Rejetto HTTP File Server (HFS) versions 3.0.0 through 3.2.0 performs state-changing administrative operations via HTTP G
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today