Read the docs
TI-2026-64042 Aliases CVE-2026-97359GHSA-2w8r-rhgc-4pch

HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection

Priority HIGH 82CWE-1336Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-1336.

Summary

HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template quoting sequence followed by an exec macro, which bypasses the authorization check in the dispatcher to execute arbitrary commands on the underlying host system.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.05516 92nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Rejettohfs22.0.0 – 2.4.0—No fix listedCNA
  • hfs2 VendorRejetto Affected 2.0.0 – 2.4.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-97359
  2. 2026-10-03 Alias added: GHSA-2w8r-rhgc-4pch
  3. 2026-10-27 EPSS moved to the 90th–95th percentile

References

Exploit 1

  • TI-2024-15709 Rejetto HTTP File Server 2.3m Unauthenticated RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05168 The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or… KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-64043 HFS2 2.4.0 Unauthenticated Arbitrary File Read/Write via Template Engine CVSS 4.0CRITICAL 10.0
  • TI-2024-26831 rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS… CVSS 3.1CRITICAL 9.9
  • TI-2026-64044 HFS2 2.4.0 Unauthenticated Denial of Service via Hung Serving Thread CVSS 4.0HIGH 8.7
  • TI-2020-10536 rejetto HFS (aka HTTP File Server) v2.3m Build #300, when virtual files or folders are… CVSS 3.1HIGH 7.5
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences