CVE-2026-61501 Overview
CVE-2026-61501 is a stored cross-site scripting (XSS) vulnerability in Rejetto HTTP File Server (HFS) versions 3.0.0 through 3.2.0. The application renders log entries in the administration panel as HTML without sanitization. A remote unauthenticated attacker can submit a failed login containing a crafted username. The malicious username is written to the error log and executes JavaScript in the administrator's browser when the logs are viewed.
The flaw is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Successful exploitation allows an attacker to create administrator accounts or execute code on the server with the administrator's privileges once an admin views the log page.
Affected Products
- Rejetto HFS 3.0.0
- Rejetto HFS versions 3.0.1 through 3.1.x
- Rejetto HFS 3.2.0
Discovery Timeline
- 2026-07-13 - CVE-2026-61501 published to the National Vulnerability Database
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2026-61501
Vulnerability Analysis
Rejetto HFS 3 records failed authentication attempts in an error log accessible through the administration panel. The log viewer renders entries as HTML instead of escaping user-controlled fields. An attacker who submits a login attempt with a username containing HTML or JavaScript payloads persists that content in the log. When an administrator subsequently opens the log viewer, the browser parses and executes the injected script in the origin of the admin interface.
Because the payload runs with the administrator's session, it can invoke any authenticated administrative action. This includes creating new privileged accounts or leveraging server-side features to execute code on the host.
Root Cause
The root cause is missing output encoding of untrusted input written to log entries. The username field from failed login attempts is stored verbatim and later rendered in the admin log viewer without HTML escaping. This falls under [CWE-79], where user input reaches a web page context without neutralization.
Attack Vector
The attack is network-based and requires no authentication. The attacker sends a single HTTP request to the login endpoint with a malicious username. The exploitation chain completes only when an administrator opens the log viewer, which introduces a user interaction requirement on the victim side. Once triggered, the payload inherits the administrator's privileges within the HFS interface.
No verified public proof-of-concept code is available. Refer to the VulnCheck Security Advisory for technical detail on the injection point.
Detection Methods for CVE-2026-61501
Indicators of Compromise
- Failed login records in HFS error logs containing HTML tags, <script> elements, or JavaScript event handlers such as onerror= and onload=
- Creation of new administrator accounts in HFS that do not match any known change request
- Outbound HTTP requests originating from the HFS host to unfamiliar domains shortly after an admin session
- Unexpected configuration changes to file shares, virtual folders, or user permissions in HFS
Detection Strategies
- Inspect HFS log files for entries where the username field contains angle brackets, encoded HTML entities, or JavaScript syntax
- Alert on HTTP POST requests to the HFS login endpoint that carry non-standard characters in credential fields
- Correlate log-viewer access by administrators with subsequent privileged actions such as account creation
Monitoring Recommendations
- Enable web server access logging in front of HFS and retain logs for review
- Monitor the HFS host process for spawned child processes that are inconsistent with normal file-serving behavior
- Track administrative account inventory changes and alert on new accounts with elevated privileges
How to Mitigate CVE-2026-61501
Immediate Actions Required
- Upgrade all HFS 3 deployments to version 3.2.1 or later, which contains the sanitization fix
- Restrict network access to the HFS administration interface using firewall rules or reverse proxy access controls
- Review the HFS user database for unauthorized administrator accounts created since deployment
- Rotate administrator credentials after patching to invalidate any sessions harvested through prior exploitation
Patch Information
The vendor released a fixed build in the HFS v3.2.1 GitHub Release. Administrators should download and deploy this build on all affected systems. Verify the version number in the admin panel after upgrade.
Workarounds
- Avoid opening the HFS log viewer in a browser session that also holds administrative privileges until the patch is applied
- Place HFS behind a reverse proxy that filters HTML metacharacters in the username parameter of login requests
- Limit administrative interface exposure to trusted management networks or VPN clients only
# Example: restrict HFS admin port to a management subnet using iptables
iptables -A INPUT -p tcp --dport 8080 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
