Stored XSS in Rejetto HFS Log Viewer

Executive Summary

CVE-2026-61501 is a stored cross-site scripting (XSS) vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0. The vulnerability occurs because the administration panel renders log entries as HTML without proper sanitization.

An unauthenticated remote attacker can exploit this by submitting a failed login attempt with a specially crafted username containing malicious JavaScript code. When an administrator views the logs, the injected script executes in their browser.

This could allow the attacker to create new accounts or execute arbitrary commands on the server with the administrator's privileges.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability on your network or system, you can check the version of Rejetto HFS you are running. The vulnerability affects versions 3.0.0 through 3.2.0. If your system is running one of these versions, it is vulnerable.

You can verify the version of HFS by accessing the administration panel or checking the version information in the application itself. There are no specific commands provided in the context, but you can look for signs of exploitation by reviewing the log entries in the Admin Log Viewer for any unusual or suspicious JavaScript code in the usernames of failed login attempts.

• Check the HFS version: Open the HFS application and look for version information in the interface or settings.
• Review log entries: Access the Admin Log Viewer and inspect the logs for any failed login attempts with unusual usernames that may contain JavaScript code.

Useful 0 Not Useful 0

Impact Analysis

If you are using Rejetto HFS versions 3.0.0 through 3.2.0, this vulnerability could have several impacts:

• An attacker could execute malicious JavaScript in the browser of an administrator who views the logs.
• The attacker could create unauthorized accounts with administrative privileges.
• The attacker could execute arbitrary code on the server, potentially leading to full system compromise.

This could result in unauthorized access to sensitive data, disruption of services, or further exploitation of your network.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with several standards and regulations, depending on the context of your organization:

• GDPR: If the server processes or stores personal data of EU citizens, a breach resulting from this vulnerability could lead to unauthorized access to that data. This may require notification to authorities and affected individuals, and could result in fines or penalties.
• HIPAA: For organizations handling protected health information (PHI), exploitation of this vulnerability could lead to unauthorized access to PHI, which is a violation of HIPAA's Security Rule. This could result in significant fines and mandatory corrective actions.
• Other standards like PCI DSS: If the server is involved in processing payment card data, this vulnerability could lead to non-compliance with PCI DSS requirements for securing systems against unauthorized access.

Failure to address this vulnerability could be seen as a lack of due diligence in protecting sensitive data, potentially leading to compliance violations and associated penalties.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade Rejetto HFS to version 3.2.1 or later. This version includes a fix for the stored XSS vulnerability in the Admin Log Viewer.

• Download and install the latest version of HFS from the official GitHub repository: https://github.com/rejetto/hfs/releases/tag/v3.2.1.
• If upgrading is not immediately possible, restrict access to the HFS administration panel to trusted IP addresses only to reduce the risk of exploitation.
• Monitor the Admin Log Viewer for any suspicious activity, such as failed login attempts with unusual usernames, and remove or sanitize such entries.

Useful 0 Not Useful 0