CVE-2026-61502
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 allows state-changing API requests via the GET method, which is exempt from anti-CSRF header checks. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution.
Risk Assessment
The risk involves potential takeover of the HFS server by an attacker who can trick an administrator into clicking a crafted URL or, in default installations, perform the attack from the server's own machine without credentials.
Recommendation
It is recommended to immediately upgrade Rejetto HFS to a version newer than 3.2.0 and implement CSRF protection for all HTTP methods, including GET.
Other vulnerabilities in Rejetto HFS
See all- CVE-2026-61500Critical
The vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 derives the session-cookie signing key from the non-cryptographic Math.random() generator and discloses its outputs to unauthenticated clients during login. A remote attacker can collect a few login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature.
- CVE-2026-61505Medium
A vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 allows a remote unauthenticated attacker to read JSON files outside shared folders by manipulating the 'lang' query parameter. Exploitation is limited to files with a narrow naming and format pattern, reducing practical impact.
- CVE-2026-61504Medium
A vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 allows XSS attacks due to improper escaping of file names in the basic web listing. An attacker with upload permissions or an anonymous user can upload a file with a malicious name that executes a script in the victim's browser.
- CVE-2026-61503Medium
Rejetto HFS versions 3.0.0 through 3.2.0 return observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticated attacker can use this to confirm valid account names, including the default admin account.
- CVE-2026-61501Medium
A vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote unauthenticated attacker can submit a failed login with a crafted username that is written to the error log and executes JavaScript in an administrator's browser when the logs are viewed.
Original NVD description (English source)
Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution - by causing a logged-in administrator's browser to navigate to a crafted URL, or without any credentials against default installations when the attack originates from the server's own machine.