Medium severity · published Jul 13, 2026
CVE-2026-61504
Rejetto HFS < 3.2.1 Stored XSS via File Names in Basic Web Listing
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Rejetto HFS 3.0.0 through 3.2.0 does not escape file names in its fallback "basic" web listing, and this listing can be forced by any browser via the ?get=basic parameter. A user with upload permission - or an anonymous user on servers with an open upload folder - can store a file whose name contains script that executes in the browser of anyone viewing the listing.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HF
hfs · rejetto
3.0.0 before 3.2.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-61504
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-61504
release-notes
https://github.com/rejetto/hfs/releases/tag/v3.2.1
third-party-advisory
https://www.vulncheck.com/advisories/rejetto-hfs-stored-xss-via-file-names-in-basic-web-listing
More from hfs
9.8
CVE-2026-61500
Rejetto HFS < 3.2.1 Session Forgery via Predictable Signing Key
6.1
CVE-2026-61501
Rejetto HFS < 3.2.1 Stored XSS in Admin Log Viewer
5.3
CVE-2026-61505
Rejetto HFS < 3.2.1 Limited File Disclosure via Path Traversal in lang Parameter
5.3
CVE-2026-61503
Rejetto HFS < 3.2.1 Username Enumeration via Login Response Differences
4.3
CVE-2026-61502
Rejetto HFS < 3.2.1 Cross-Site Request Forgery via GET Requests