Rejetto HFS
CVE-2026-61505
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no auth or interaction (AV:N/PR:N/UI:N); confidentiality limited to narrow JSON subset, scope unchanged, no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthenticated attacker to read certain JSON files outside the shared folders. Exploitation is constrained to files matching a narrow naming and format pattern, limiting practical impact.
AnalysisAI
Path traversal via the lang query parameter in Rejetto HFS 3.0.0 through 3.2.0 enables remote unauthenticated attackers to read JSON files outside the application's designated shared folders. Exploitation is constrained by the application's own file-loading logic - only files matching a narrow naming convention and JSON format are reachable, limiting impact to partial information disclosure rather than arbitrary file read. Vendor-released patch v3.2.1 is available; no KEV listing or confirmed public exploit exists, though the same release addresses additional higher-severity vulnerabilities noted in the release notes.
Technical ContextAI
Rejetto HFS (HTTP File Server) is a lightweight, self-contained file-sharing web application. The lang query parameter is used by HFS to load language/localization resources - the application resolves a file path based on this parameter without sufficient sanitization, a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) root cause. An attacker supplies directory traversal sequences in the lang value, causing the server to resolve a path outside the shared folder tree. The traversal is bounded by the application's own logic: it likely appends a .json extension or enforces a naming pattern for localization files, preventing read of arbitrary binary or text files. CPE cpe:2.3:a:rejetto:hfs:*:*:*:*:*:*:*:* covers all affected versions 3.0.0-3.2.0 of the application product line.
RemediationAI
Upgrade to Rejetto HFS version 3.2.1 immediately, available at https://github.com/rejetto/hfs/releases/tag/v3.2.1. This is a security-focused release that patches this path traversal as well as additional undisclosed vulnerabilities that may permit administrative access - the upgrade is warranted even if the standalone risk of this CVE appears limited. If immediate upgrade is not feasible, restrict network access to the HFS instance to trusted IP ranges via firewall or place it behind an authenticated reverse proxy, which prevents unauthenticated exploitation at the cost of added operational complexity and potential disruption to open file-sharing workflows. The VulnCheck advisory at https://www.vulncheck.com/advisories/rejetto-hfs-limited-file-disclosure-via-path-traversal-in-lang-parameter provides additional technical context.
Administrator session forgery in Rejetto HFS (HTTP File Server) versions 3.0.0 through 3.2.0 lets a remote unauthenticat
Username enumeration in Rejetto HFS 3.0.0-3.2.0 exposes valid account names-including the default admin account-to remot
Stored cross-site scripting in Rejetto HTTP File Server 3.0.0-3.2.0 allows an unauthenticated remote attacker to inject
Rejetto HTTP File Server (HFS) versions 3.0.0 through 3.2.0 performs state-changing administrative operations via HTTP G
Stored XSS in Rejetto HFS 3.0.0 through 3.2.0 allows attackers with upload access - or any user on servers configured wi
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today