EUVD-2026-85880
GHSA-3j4w-pf2p-gw5r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network attack with no user interaction; scope changes because the flaw in HFS grants access to host files beyond the application boundary, with full CIA impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside the shared folder. Attackers can exploit the macro dispatcher's lack of authorization model combined with the path resolver's failure to confine absolute paths to manipulate the template engine and compromise the confidentiality, integrity, and availability of the host.
AnalysisAI
Unauthenticated arbitrary file read, write, append, and delete in Rejetto HFS2 up to and including 2.4.0 allows remote attackers to compromise the confidentiality, integrity, and availability of the host filesystem. The vulnerability arises because the template engine's macro dispatcher performs no authorization check and the path resolver fails to confine absolute paths to the shared folder, letting attackers manipulate macros to access files anywhere the HFS service account has permissions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions beyond network reachability - remote unauthenticated exploitation works against default configurations of Rejetto HFS2 up to and including 2.4.0, because the template engine's macro dispatcher performs no authorization check and the path resolver does not confine absolute paths to the shared folder. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority issue, not a high-CVSS-but-low-risk artifact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Rejetto HFS2 instance at version 2.4.0 or earlier and take any externally reachable ones offline - block inbound access at the firewall, stop the service, or shut the host down; where the service must keep running, run it under a least-privilege account with no write access to sensitive data, relocate its shared folder to an isolated volume, and rotate credentials for the account the service uses. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote code execution in Rejetto HFS2 (HTTP File Server) through version 2.4.0 lets an attacker execute
Unauthenticated denial of service in Rejetto HFS2 2.4.0 and earlier lets a remote attacker take the entire file server o
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today