Read the docs
TI-2024-01140 Aliases CVE-2024-1226GHSA-9rpw-6ghh-qx6q

Multiple vulnerabilities in Rejetto's Http File Server

Priority LOW 39CWE-93Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The software does not neutralize or incorrectly neutralizes certain characters before the data is included in outgoing HTTP headers. The inclusion of invalidated data in an HTTP header allows an attacker to specify the full HTTP response represented by the browser. An attacker could control the response and craft attacks such as cross-site scripting and cache poisoning attacks.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00449 39th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
RejettoHttp File Server 2.2a, build #124—No fix listedCNA
  • Http File Server VendorRejetto Affected 2.2a, build #124 Fixed in — No fix listed CNA

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:rejetto:http_file_server:2.2a:*:*:*:*:*:*:*2.2a—Rejetto
  • cpe:2.3:a:rejetto:http_file_server:2.2a:*:*:*:*:*:*:* Versions 2.2a — ·Rejetto

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-1226
  2. 2026-10-03 Alias added: GHSA-9rpw-6ghh-qx6q

References

Other 1

  • TI-2024-15709 Rejetto HTTP File Server 2.3m Unauthenticated RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05168 The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or… KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-64043 HFS2 2.4.0 Unauthenticated Arbitrary File Read/Write via Template Engine CVSS 4.0CRITICAL 10.0
  • TI-2026-64042 HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection CVSS 4.0CRITICAL 10.0
  • TI-2024-26831 rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS… CVSS 3.1CRITICAL 9.9
  • TI-2026-64044 HFS2 2.4.0 Unauthenticated Denial of Service via Hung Serving Thread CVSS 4.0HIGH 8.7
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences