Rejetto vulnerabilities
We track 8 vulnerabilities in Rejetto products across 3 products. 8 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on September 24, 2026.
Latest Rejetto vulnerabilities
- 7.5 High severity
hfs2: Loop with Unreachable Exit Condition
HFS2 version 2.4.0 and earlier contains a denial of service vulnerability that allows unauthenticated attackers to cause a complete and persistent loss of availability by sending a single crafted request. Attackers can trigger a hung serving thread that enters
- 10.0 Critical severity
hfs2: Missing Authorization
HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside the shared folder. Atta
- 10.0 Critical severity
hfs2: Improper Neutralization of Special Elements Used in a Template Engine
HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filena
- 9.8 Critical severity
hfs: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login
- 8.8 High severity
http_file_server: Improper Neutralization of Special Elements used in an OS Command
rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSy
- 9.8 Critical severity
Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Exploited
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HT
- 7.5 High severity
Http File Server: Improper Neutralization of CRLF Sequences
The software does not neutralize or incorrectly neutralizes certain characters before the data is included in outgoing HTTP headers. The inclusion of invalidated data in an HTTP header allows an attacker to specify the full HTTP response represented by the bro
- 9.8 Critical severity
Rejetto HTTP File Server (HFS) Remote Code Execution Exploited
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.