CVE-2026-61505: Rejetto HFS Path Traversal Vulnerability

CVE-2026-61505 Overview

CVE-2026-61505 is a path traversal vulnerability [CWE-22] in Rejetto HFS (HTTP File Server) versions 3.0.0 through 3.2.0. The flaw resides in the handling of the lang query parameter, which fails to properly sanitize traversal sequences. A remote unauthenticated attacker can read certain JSON files located outside the configured shared folders. Exploitation is constrained to files matching a specific naming and format pattern, which limits practical impact to information disclosure of narrowly-scoped files. The vendor addressed the issue in Rejetto HFS v3.2.1.

Critical Impact
Remote unauthenticated attackers can read JSON files outside shared folders via the lang parameter, but exploitation is limited by strict file-format constraints.

Affected Products

Rejetto HFS 3.0.0
Rejetto HFS 3.1.x
Rejetto HFS 3.2.0

Discovery Timeline

2026-07-13 - CVE-2026-61505 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-61505

Vulnerability Analysis

Rejetto HFS is a self-contained HTTP File Server used to share files over the web. The application accepts a lang query parameter to select localization resources loaded from JSON language files. The parameter handler concatenates the user-supplied value into a file path without adequately filtering directory traversal sequences such as ../. As a result, an attacker can direct the server to load JSON files from arbitrary locations on the host file system. The server returns the parsed content in the response, producing an information disclosure primitive. Exploitation is unauthenticated and requires only network access to the HFS listener.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The language-loading routine trusts the lang value and resolves it relative to the resources directory without canonicalizing the final path or verifying that it remains within the intended base. The vulnerability is scoped to files that both match an expected naming convention and parse as valid JSON, which prevents disclosure of arbitrary text or binary content.

Attack Vector

Exploitation occurs over the network by issuing a crafted HTTP request to the HFS endpoint with a lang query parameter containing traversal sequences pointing to a target JSON file. No authentication, user interaction, or elevated privileges are required. The server responds with the contents of the referenced file when the file exists and matches the loader's expected format. See the VulnCheck advisory for technical specifics.

Detection Methods for CVE-2026-61505

Indicators of Compromise

HTTP requests to HFS containing the lang query parameter with traversal sequences such as ../ or URL-encoded equivalents (%2e%2e%2f).
Access log entries where the lang value references paths outside the HFS resources directory.
Repeated lang parameter probing from a single source enumerating candidate JSON file names.

Detection Strategies

Inspect HFS access logs for anomalous lang values that do not match the set of supported language codes.
Deploy web application firewall rules that flag directory traversal patterns in query string parameters targeting the HFS listener.
Alert on outbound responses from HFS containing JSON payloads whose structure does not match a language resource file.

Monitoring Recommendations

Enable verbose HTTP request logging on HFS instances exposed to untrusted networks and forward logs to a centralized analytics platform.
Track process and file-access telemetry on hosts running HFS to identify reads of JSON files outside the shared folder tree.
Establish a baseline of legitimate lang values and alert on deviations.

How to Mitigate CVE-2026-61505

Immediate Actions Required

Upgrade Rejetto HFS to version 3.2.1 or later, which contains the vendor fix.
Restrict network exposure of HFS by placing the service behind a reverse proxy or VPN where feasible.
Audit HFS access logs for prior exploitation attempts referencing the lang parameter.

Patch Information

The vendor released the fix in Rejetto HFS v3.2.1. Administrators should download the updated release from the official GitHub repository and replace the running binary. Verify the running version through the HFS administration interface after the upgrade.

Workarounds

Block or filter HTTP requests containing traversal sequences in the lang parameter using a reverse proxy or WAF rule.
Restrict access to the HFS listener with host-based firewall rules limiting connections to trusted source addresses.
Run HFS under a low-privilege service account with file-system permissions that deny read access to sensitive JSON files outside the shared directory.

bash

# Example reverse proxy rule (nginx) to block traversal in the lang parameter
if ($arg_lang ~* "(\.\./|%2e%2e%2f|\.\.\\)") {
    return 400;
}