Read the docs
TI-2026-44081 Aliases CVE-2026-61501GHSA-fmrm-mcm3-c952

Rejetto HFS < 3.2.1 Stored XSS in Admin Log Viewer

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Rejetto HFS 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote unauthenticated attacker can submit a failed login with a crafted username that is written to the error log and executes JavaScript in an administrator's browser when the logs are viewed, allowing the attacker to create accounts or execute code on the server with the administrator's privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00419 36th percentileScored 2026-11-07
Fix Fixed hfs (rejetto): 3.2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Rejettohfs3.0.0 to before 3.2.13.2.1Patch availableCNA
  • hfs VendorRejetto Affected 3.0.0 to before 3.2.1 Fixed in 3.2.1 Patch available CNA

Remediation

  • Fix · CNA hfs (rejetto) Fixed in 3.2.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    rejetto hfs 3.2.1

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2026-44080 Rejetto HFS < 3.2.1 Session Forgery via Predictable Signing KeyPriority MEDIUM 52
    • TI-2026-44085 Rejetto HFS < 3.2.1 Limited File Disclosure via Path Traversal in lang ParameterPriority LOW 37
    • TI-2026-44083 Rejetto HFS < 3.2.1 Username Enumeration via Login Response DifferencesPriority LOW 37
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-61501
  2. 2026-10-03 Alias added: GHSA-fmrm-mcm3-c952

References

Patch 1

  • TI-2024-15709 Rejetto HTTP File Server 2.3m Unauthenticated RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05168 The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or… KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-64043 HFS2 2.4.0 Unauthenticated Arbitrary File Read/Write via Template Engine CVSS 4.0CRITICAL 10.0
  • TI-2026-64042 HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection CVSS 4.0CRITICAL 10.0
  • TI-2024-26831 rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS… CVSS 3.1CRITICAL 9.9
  • TI-2026-64044 HFS2 2.4.0 Unauthenticated Denial of Service via Hung Serving Thread CVSS 4.0HIGH 8.7
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences