CVE-2026-61505

MEDIUM

Rejetto HFS < 3.2.1 Limited File Disclosure via Path Traversal in lang Parameter

Title source: cna

Description

Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthenticated attacker to read certain JSON files outside the shared folders. Exploitation is constrained to files matching a narrow naming and format pattern, limiting practical impact.

References (2)

Core 2

Core References

Patch release-notes patch

Release Notes

https://github.com/rejetto/hfs/releases/tag/v3.2.1

Third Party Advisory third-party-advisory

https://www.vulncheck.com/advisories/rejetto-hfs-limited-file-disclosure-via-path-traversal-in-lang-parameter

Scores

CVSS v3 5.3

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-22

Status published

Products (1)

rejetto/hfs 3.0.0 - 3.2.1

Published Jul 13, 2026

Tracked Since Jul 13, 2026