Is CVE-2026-61502 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61502 being exploited in the wild.

How severe is CVE-2026-61502?

Medium severity, with a CVSS score of 4.3, published 13 July 2026.

Which products and versions are affected?

Rejetto HTTP File Server 3.0.0 through 3.2.0.

Is there a fix for CVE-2026-61502?

A patch was published on 2026-07-13: Version 3.2.1 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61502 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-61502?

Check whether you run Rejetto HTTP File Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61502: Rejetto HFS CSRF in API via GET requests

CVE-2026-61502 · Severity: medium · CVSS 4.3 · Published 2026-07-13

Rejetto HFS, a popular file-sharing server, contains a security flaw that allows unauthorized administrative actions. By tricking a logged-in administrator into clicking a malicious link, an attacker can change server settings or create new accounts. In some default setups, this could even allow an attacker to take full control of the server and execute malicious code.

Technologies: Rejetto HTTP File Server. Vendors: Rejetto.

Quick answers

Is CVE-2026-61502 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61502 being exploited in the wild.
How severe is CVE-2026-61502?: Medium severity, with a CVSS score of 4.3, published 13 July 2026.
Which products and versions are affected?: Rejetto HTTP File Server 3.0.0 through 3.2.0.
Is there a fix for CVE-2026-61502?: A patch was published on 2026-07-13: Version 3.2.1 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61502 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-61502?: Check whether you run Rejetto HTTP File Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in Rejetto HFS versions 3.0.0 through 3.2.0. The application's API incorrectly allows state-changing operations to be performed using HTTP GET requests, which are exempted from the anti-CSRF header validation mechanism. An attacker can exploit this by inducing an authenticated administrator to visit a specially crafted URL. Successful exploitation allows for administrative actions such as account creation and configuration changes, which can be further leveraged to achieve remote code execution. The vulnerability is patched in version 3.2.1.

Affected products

Rejetto HFS (HTTP File Server) 3.0.0 through 3.2.0

Timeline

2026-07-13: advisory: NVD and VulnCheck published the advisory
2026-07-13: patched: Version 3.2.1 released to address the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.