CVE-2026-61504 Overview
CVE-2026-61504 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Rejetto HFS (HTTP File Server) versions 3.0.0 through 3.2.0. The fallback basic web listing does not escape file names before rendering them in the browser. Any client can force this listing by appending the ?get=basic query parameter to a directory URL.
An authenticated user with upload permission can plant a file whose name contains HTML or JavaScript. On servers configured with an open upload folder, an anonymous user can achieve the same result. The malicious script executes in the browser of any visitor who views the affected directory listing.
Critical Impact
Attackers can execute arbitrary JavaScript in the browser context of any user viewing a directory listing, enabling session theft, credential harvesting, and further client-side attacks against HFS administrators.
Affected Products
- Rejetto HFS 3.0.0
- Rejetto HFS versions 3.0.0 through 3.2.0
- Fixed in Rejetto HFS 3.2.1
Discovery Timeline
- 2026-07-13 - CVE-2026-61504 published to NVD
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2026-61504
Vulnerability Analysis
Rejetto HFS ships with a modern JavaScript-driven front-end for browsing shared files. It also retains a fallback listing template referred to as the basic view, intended for lightweight or legacy clients. Any browser can invoke this alternate view by appending ?get=basic to a directory URL, regardless of server configuration.
The basic listing renderer emits file names directly into the HTML response without applying output encoding. When a file name contains characters such as <, >, ", or ', the browser interprets them as HTML markup rather than literal text. An attacker who controls a file name can therefore inject a <script> tag or an event handler attribute that runs in the origin of the HFS server.
The payload persists as long as the file exists on disk, making this a stored XSS rather than a reflected one. Every visitor who opens the affected directory in basic mode triggers execution.
Root Cause
The root cause is missing output sanitization in the basic listing template. The modern default view escapes file names correctly, so the flaw was overlooked in the fallback code path. Because the ?get=basic parameter is client-controlled, an attacker can guarantee the vulnerable renderer is used even when administrators never rely on it.
Attack Vector
Exploitation requires two conditions. First, the attacker needs the ability to create a file with an attacker-chosen name on the server. This is available to any user with upload permission or, on misconfigured deployments, to unauthenticated users who reach a writable folder. Second, a victim must load the target directory using the basic listing.
The attacker can distribute a crafted link containing ?get=basic through phishing or social engineering. When the HFS operator or another authenticated user opens the link, the script executes with access to session cookies, CSRF tokens, and any administrative interface exposed by HFS. Refer to the VulnCheck Rejetto HFS XSS Advisory for further technical detail.
Detection Methods for CVE-2026-61504
Indicators of Compromise
- File names in HFS shared directories containing HTML control characters such as <, >, or script
- HTTP access logs showing requests to directory paths with the ?get=basic query parameter
- Unexpected outbound requests from administrator browsers immediately after viewing a shared directory
- Newly uploaded files with unusually long names or names containing on-event handler strings like onerror= or onload=
Detection Strategies
- Scan the HFS storage volume for filenames matching a regex such as [<>"']|on\w+=|<script` and alert on matches
- Inspect HFS access logs for GET requests carrying get=basic and correlate with authenticated administrator sessions
- Monitor for anomalous JavaScript execution or outbound connections initiated from browsers of users who administer HFS
Monitoring Recommendations
- Enable verbose HTTP logging on the HFS instance and forward logs to a central SIEM for pattern matching
- Alert on file upload events where the submitted filename contains HTML metacharacters
- Track HFS version banners across the environment to identify unpatched hosts running 3.0.0 through 3.2.0
How to Mitigate CVE-2026-61504
Immediate Actions Required
- Upgrade all Rejetto HFS instances to version 3.2.1 or later, which contains the fix for CVE-2026-61504
- Audit existing shared directories and remove any files whose names contain HTML or JavaScript syntax
- Review upload permissions and disable anonymous write access to publicly reachable folders
- Instruct administrators to avoid appending ?get=basic to directory URLs until patching is complete
Patch Information
Rejetto released version 3.2.1 to address this vulnerability. The release notes and download are available on the GitHub HFS Release v3.2.1 page. Applying the update replaces the vulnerable basic listing template with a version that properly escapes file names before rendering.
Workarounds
- Restrict upload permissions to trusted accounts only and remove anonymous upload rights
- Place HFS behind a reverse proxy that strips or blocks requests containing the get=basic query parameter
- Enforce a Content Security Policy header that disallows inline script execution to limit payload impact
- Rename or quarantine any existing files whose names contain HTML control characters until the server is patched
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
