# HFS missing rel attribute in web links allows tab hijacking

Source: https://junglewise.ai/threats/hfs-missing-rel-attribute-in-web-links-allows-tab-hijacking-7c3dca54  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 4 · Published 2025-08-12

HFS is a file-sharing application that allows administrators to add web links within the virtual filesystem. When these links are clicked, they open in a new browser tab but without security attributes that prevent the external site from controlling the original HFS page. An attacker who compromises a previously-safe linked website can redirect users back to a phishing page, potentially stealing HFS login credentials or other sensitive information, especially for users running older browsers.

Technologies: [Rejetto HFS](https://junglewise.ai/threats/technologies/hfs). Vendors: [Rejetto](https://junglewise.ai/threats/vendors/rejetto).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 4, published 12 August 2025.

**Which products and versions are affected?** Rejetto HFS before 0.57.10.

**Is there a fix for This vulnerability?** A patch was published on 2025-08-12: Fixed in version 0.57.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Rejetto HFS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability stems from missing rel="noopener noreferrer" attributes on hyperlinks opened with target="_blank". When external links lack these attributes, the opened page can access the window.opener property and change the location of the originating tab. The vulnerability requires an attacker to compromise a third-party website that an HFS administrator has legitimately linked to; no compromise of the HFS admin account itself is necessary. Attack preconditions include the user clicking the malicious link and running an older browser without built-in protections (most modern browsers have mitigated this at the browser level). The fix was released in HFS version 0.57.10, which adds the required rel="noopener noreferrer" attributes to external links.

## Affected products

- rejetto HFS before 0.57.10

## Timeline

- 2025-08-12: disclosed
- 2025-08-12: patched: Fixed in version 0.57.10

## References

- [https://github.com/rejetto/hfs/security/advisories/GHSA-xcxh-6cv4-q8p8](https://github.com/rejetto/hfs/security/advisories/GHSA-xcxh-6cv4-q8p8)
- [https://github.com/rejetto/hfs/commit/6531bcd2ab285af88f91831e30d8a03f5b9fe20d](https://github.com/rejetto/hfs/commit/6531bcd2ab285af88f91831e30d8a03f5b9fe20d)

## Related threats

- [Rejetto HFS username enumeration in login endpoint](https://junglewise.ai/threats/cve-2026-61503-rejetto-hfs-username-enumeration-in-login-endpoint)
- [rejetto HFS OS command execution in upload handling](https://junglewise.ai/threats/cve-2024-39943-rejetto-hfs-os-command-execution-in-upload-handling)