# CVE-2026-61505: Rejetto HFS path traversal in lang parameter

Source: https://junglewise.ai/threats/cve-2026-61505-rejetto-hfs-path-traversal-in-lang-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-61505 · Severity: medium · CVSS 5.3 · Published 2026-07-13

Rejetto HFS, a popular tool for sharing files over the internet, contains a security flaw that allows unauthorized users to access certain internal files. An attacker could exploit this to view specific configuration or data files that are not intended to be public. While the impact is limited to files with a specific format, it could still lead to the exposure of sensitive system information.

Technologies: [Rejetto HFS (HTTP File Server)](https://junglewise.ai/threats/technologies/hfs-http-file-server). Vendors: [Rejetto](https://junglewise.ai/threats/vendors/rejetto).

## Quick answers

**Is CVE-2026-61505 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61505 being exploited in the wild.

**How severe is CVE-2026-61505?** Medium severity, with a CVSS score of 5.3, published 13 July 2026.

**Which products and versions are affected?** Rejetto HFS (HTTP File Server) 3.0.0 through 3.2.0.

**Is there a fix for CVE-2026-61505?** A patch was published on 2026-07-13: Version 3.2.1 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61505 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-61505?** Check whether you run Rejetto HFS (HTTP File Server) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability (CWE-22) exists in Rejetto HFS versions 3.0.0 through 3.2.0 within the 'lang' query parameter. A remote, unauthenticated attacker can exploit this by submitting specially crafted requests to access files outside of the designated shared directories. The exploit is constrained by the application's logic to only retrieve files that match a specific JSON naming and format pattern, which limits the scope of the data disclosure. The issue is resolved in version 3.2.1.

## Affected products

- Rejetto HFS (HTTP File Server) 3.0.0 through 3.2.0

## Timeline

- 2026-07-13: advisory: NVD and VulnCheck published the advisory
- 2026-07-13: patched: Version 3.2.1 released to address the issue

## References

- [https://github.com/rejetto/hfs/releases/tag/v3.2.1](https://github.com/rejetto/hfs/releases/tag/v3.2.1)
- [https://www.vulncheck.com/advisories/rejetto-hfs-limited-file-disclosure-via-path-traversal-in-lang-parameter](https://www.vulncheck.com/advisories/rejetto-hfs-limited-file-disclosure-via-path-traversal-in-lang-parameter)

## Related threats

- [Rejetto HFS stored XSS in basic web listing via file names](https://junglewise.ai/threats/cve-2026-61504-rejetto-hfs-stored-xss-in-basic-web-listing-via-file-names)
- [Rejetto HFS session cookie signing key forgery in HFS 3.x](https://junglewise.ai/threats/cve-2026-61500-rejetto-hfs-session-cookie-signing-key-forgery-in-hfs-3-x)