Executive brief
Rejetto HFS, a popular lightweight file server, contains a security flaw in how it handles system logs. An unauthorized attacker can submit a specially crafted login attempt that injects malicious code into the server's logs. When an administrator later views these logs, the code executes in their browser, potentially allowing the attacker to take over the server, create new accounts, or steal sensitive data.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Rejetto HFS versions 3.0.0 through 3.2.0 due to improper neutralization of input during web page generation (CWE-79). The application fails to sanitize log entries before rendering them in the administration panel. A remote, unauthenticated attacker can trigger this by submitting a failed login attempt with a malicious payload in the username field. When an administrator views the error logs, the payload executes JavaScript in their browser context. This can be leveraged to perform administrative actions, such as account creation or remote code execution, using the administrator's session. The issue is resolved in version 3.2.1.
Affected products
- Rejetto HFS (HTTP File Server) 3.0.0 through 3.2.0
Timeline
- 2026-07-13: advisory: NVD and VulnCheck published the advisory.
- 2026-07-13: patched: Version 3.2.1 released to address the vulnerability.