Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 4, published 12 August 2025.

Is there a fix for This vulnerability?

A patch was published on 2025-08-12: Fixed in version 0.57.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Rejetto HFS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

HFS missing rel attribute in web links allows tab hijacking

Severity: medium · CVSS 4 · Published 2025-08-12

HFS is a file-sharing application that allows administrators to add web links within the virtual filesystem. When these links are clicked, they open in a new browser tab but without security attributes that prevent the external site from controlling the original HFS page. An attacker who compromises a previously-safe linked website can redirect users back to a phishing page, potentially stealing HFS login credentials or other sensitive information, especially for users running older browsers.

Technologies: Rejetto HFS. Vendors: Rejetto.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 4, published 12 August 2025.
Which products and versions are affected?: Rejetto HFS before 0.57.10.
Is there a fix for This vulnerability?: A patch was published on 2025-08-12: Fixed in version 0.57.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Rejetto HFS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability stems from missing rel="noopener noreferrer" attributes on hyperlinks opened with target="_blank". When external links lack these attributes, the opened page can access the window.opener property and change the location of the originating tab. The vulnerability requires an attacker to compromise a third-party website that an HFS administrator has legitimately linked to; no compromise of the HFS admin account itself is necessary. Attack preconditions include the user clicking the malicious link and running an older browser without built-in protections (most modern browsers have mitigated this at the browser level). The fix was released in HFS version 0.57.10, which adds the required rel="noopener noreferrer" attributes to external links.

Affected products

rejetto HFS before 0.57.10

Timeline

2025-08-12: disclosed
2025-08-12: patched: Fixed in version 0.57.10

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.