# CVE-2026-97359: HFS2 template injection in multipart upload handler

Source: https://junglewise.ai/threats/cve-2026-97359-hfs2-version-2-4-0-and-earlier-contains-a-template-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-97359 · Severity: critical · CVSS 10 · Published 2026-09-24

HFS2 is a file hosting server that allows users to upload and share files over the network. An attacker can craft a malicious filename during file upload to inject template code that executes arbitrary commands on the server, gaining complete control of the system without needing valid credentials.

Technologies: [Wgetnz HFS2](https://junglewise.ai/threats/technologies/hfs2). Vendors: [Wgetnz](https://junglewise.ai/threats/vendors/wgetnz).

## Quick answers

**Is CVE-2026-97359 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97359 being exploited in the wild.

**How severe is CVE-2026-97359?** Critical severity, with a CVSS score of 10, published 24 September 2026.

**Which products and versions are affected?** Wgetnz HFS2 2.0.0 through 2.4.0.

**Is there a fix for CVE-2026-97359?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-97359 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-97359?** Check whether you run Wgetnz HFS2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The multipart upload handler fails to properly sanitize template syntax in filenames, allowing template injection via closing quotes and exec macros. An unauthenticated attacker can send a crafted multipart form upload with a malicious filename to bypass authorization checks and achieve remote code execution on the host system. The vulnerability affects versions 2.0.0 through 2.4.0.

## Affected products

- wgetnz HFS2 2.0.0 through 2.4.0

## Timeline

- 2026-09-24: disclosed

## References

- [https://github.com/wgetnz/hfs2/blob/master/advisories/hfs2-upload-filename-template-injection/README.md](https://github.com/wgetnz/hfs2/blob/master/advisories/hfs2-upload-filename-template-injection/README.md)
- [https://www.vulncheck.com/advisories/hfs2-rce-via-multipart-upload-filename-template-injection](https://www.vulncheck.com/advisories/hfs2-rce-via-multipart-upload-filename-template-injection)

## Related threats

- [HFS2 denial of service via hung serving thread](https://junglewise.ai/threats/cve-2026-97362-hfs2-version-2-4-0-and-earlier-contains-a-denial-of-service)
- [HFS2 unauthenticated arbitrary file access in template engine](https://junglewise.ai/threats/cve-2026-97360-hfs2-version-2-4-0-and-earlier-contains-an-unauthenticated)