# CVE-2026-61501: Rejetto HFS stored XSS in admin log viewer

Source: https://junglewise.ai/threats/cve-2026-61501-rejetto-hfs-stored-xss-in-admin-log-viewer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-61501 · Severity: medium · CVSS 6.1 · Published 2026-07-13

Rejetto HFS, a popular lightweight file server, contains a security flaw in how it handles system logs. An unauthorized attacker can submit a specially crafted login attempt that injects malicious code into the server's logs. When an administrator later views these logs, the code executes in their browser, potentially allowing the attacker to take over the server, create new accounts, or steal sensitive data.

Technologies: [Rejetto HTTP File Server](https://junglewise.ai/threats/technologies/http-file-server). Vendors: [Rejetto](https://junglewise.ai/threats/vendors/rejetto).

## Quick answers

**Is CVE-2026-61501 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61501 being exploited in the wild.

**How severe is CVE-2026-61501?** Medium severity, with a CVSS score of 6.1, published 13 July 2026.

**Which products and versions are affected?** Rejetto HTTP File Server 3.0.0 through 3.2.0.

**Is there a fix for CVE-2026-61501?** A patch was published on 2026-07-13: Version 3.2.1 released to address the vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61501 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-61501?** Check whether you run Rejetto HTTP File Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in Rejetto HFS versions 3.0.0 through 3.2.0 due to improper neutralization of input during web page generation (CWE-79). The application fails to sanitize log entries before rendering them in the administration panel. A remote, unauthenticated attacker can trigger this by submitting a failed login attempt with a malicious payload in the username field. When an administrator views the error logs, the payload executes JavaScript in their browser context. This can be leveraged to perform administrative actions, such as account creation or remote code execution, using the administrator's session. The issue is resolved in version 3.2.1.

## Affected products

- Rejetto HFS (HTTP File Server) 3.0.0 through 3.2.0

## Timeline

- 2026-07-13: advisory: NVD and VulnCheck published the advisory.
- 2026-07-13: patched: Version 3.2.1 released to address the vulnerability.

## References

- [https://github.com/rejetto/hfs/releases/tag/v3.2.1](https://github.com/rejetto/hfs/releases/tag/v3.2.1)
- [https://www.vulncheck.com/advisories/rejetto-hfs-stored-xss-in-admin-log-viewer](https://www.vulncheck.com/advisories/rejetto-hfs-stored-xss-in-admin-log-viewer)

## Related threats

- [Rejetto HFS CSRF in API via GET requests](https://junglewise.ai/threats/cve-2026-61502-rejetto-hfs-csrf-in-api-via-get-requests)
- [Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability](https://junglewise.ai/threats/cve-2024-23692-rejetto-http-file-server-improper-neutralization-of-special)