Auth bypass in Rejetto Hfs2
CVE-2026-97360
HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside the shared folder. Attackers can exploit the macro dispatcher's lack of authorization model combined with the path resolver's failure to confine absolute paths to manipulate the template engine and compromise the confidentiality, integrity, and availability of the host.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/wgetnz/hfs2/blob/master/advisories/hfs2-template-macro-missing-autho… (technical-description, exploit)
- www.vulncheck.com/advisories/hfs2-unauthenticated-arbitrary-file-read-write-via… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-97360?
- CVE-2026-97360 is a critical-severity vulnerability in Rejetto Hfs2, classified under Missing Authorization. CVSS score: 10.0/10. Published 2026-09-24.
- How severe is CVE-2026-97360?
- Critical severity. CVSS v3 base score is 10.0 out of 10.