CVE-2026-61505
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 allows a remote unauthenticated attacker to read JSON files outside shared folders by manipulating the 'lang' query parameter. Exploitation is limited to files with a narrow naming and format pattern, reducing practical impact.
Risk Assessment
The risk for the organization involves potential leakage of sensitive data stored in JSON files that meet specific naming and format criteria, which could lead to a breach of information confidentiality.
Recommendation
It is recommended to immediately update Rejetto HFS to the latest available version that fixes this vulnerability. Until the update is applied, restrict access to the HFS server to trusted networks only.
Other vulnerabilities in Rejetto HFS
See all- CVE-2026-61500Critical
The vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 derives the session-cookie signing key from the non-cryptographic Math.random() generator and discloses its outputs to unauthenticated clients during login. A remote attacker can collect a few login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature.
- CVE-2026-61504Medium
A vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 allows XSS attacks due to improper escaping of file names in the basic web listing. An attacker with upload permissions or an anonymous user can upload a file with a malicious name that executes a script in the victim's browser.
- CVE-2026-61503Medium
Rejetto HFS versions 3.0.0 through 3.2.0 return observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticated attacker can use this to confirm valid account names, including the default admin account.
- CVE-2026-61502Medium
A vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 allows state-changing API requests via the GET method, which is exempt from anti-CSRF header checks. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution.
- CVE-2026-61501Medium
A vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote unauthenticated attacker can submit a failed login with a crafted username that is written to the error log and executes JavaScript in an administrator's browser when the logs are viewed.
Original NVD description (English source)
Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthenticated attacker to read certain JSON files outside the shared folders. Exploitation is constrained to files matching a narrow naming and format pattern, limiting practical impact.