Rejetto HFS CVE-2026-61505

The target must be running Rejetto HFS version 3.0.0 through 3.2.0 and must be reachable over the network by the attacker. No authentication is required (PR:N per the provided CVSS 4.0 vector). Exploitation is meaningfully constrained: only files that (1) are in JSON format, (2) match the naming pattern expected by HFS's lang parameter file-loading routine, and (3) reside at a traversable path relative to the application root can be read - arbitrary file system read is not possible. Attackers must know or correctly guess valid path traversal targets fitting these constraints. The attack is limited to reading data; no write, delete, or code execution primitive is present in this CVE.

The CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) reflects a low-complexity, unauthenticated network attack yielding only low confidentiality impact on the vulnerable system - consistent with the description's explicit constraint that only narrowly-patterned JSON files are reachable. No integrity or availability impact is present. No CISA KEV listing and no confirmed public exploit code reduce operational urgency for this specific CVE. However, the v3.2.1 release notes explicitly state that prior versions contain 'multiple security vulnerabilities' capable of enabling administrative access to HFS - this path traversal CVE is one component of a broader security release, and the full scope of co-disclosed issues elevates the overall patching priority beyond what this CVE's standalone score suggests. EPSS data was not provided; given no KEV and constrained impact, opportunistic mass exploitation appears unlikely.

An unauthenticated remote attacker sends an HTTP GET request to an exposed HFS 3.x instance with a crafted lang parameter containing directory traversal sequences such as ../../config or similar, targeting predictably named JSON files outside the shared folder. The server resolves the traversed path, matches a file fitting the naming/format constraints of the lang loader, and returns its contents in the HTTP response. Disclosed JSON data - such as configuration fragments - could expose information useful for subsequent higher-privilege attacks, particularly given the co-disclosed vulnerabilities in the same v3.2.1 release.