Path Traversal in Rejetto HFS via Lang Parameter

Executive Summary

CVE-2026-61505 is a path traversal vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0. It allows a remote unauthenticated attacker to read certain JSON files outside the shared folders by exploiting the 'lang' query parameter.

The vulnerability is constrained because it only affects files matching a specific naming and format pattern, which limits its practical impact. It is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Useful 0 Not Useful 0

Detection Guidance

To detect the vulnerability (CVE-2026-61505) on your network or system, you can check if the Rejetto HFS software version falls within the affected range (3.0.0 through 3.2.0). Additionally, you can test for the path traversal vulnerability by sending crafted HTTP requests to the HFS server.

• Check the HFS version: Verify the installed version of Rejetto HFS. If it is between 3.0.0 and 3.2.0, the system is vulnerable.
• Test for path traversal: Use a tool like curl to send a request with the 'lang' parameter set to traverse directories, for example: curl "http://<HFS_SERVER_IP>:<PORT>/?lang=../../../../path/to/file.json". Replace <HFS_SERVER_IP> and <PORT> with the appropriate values, and adjust the path to target known JSON files.
• Monitor network traffic: Use network monitoring tools to detect unusual requests targeting the 'lang' parameter, which may indicate exploitation attempts.

Note that exploitation is constrained to files matching a specific naming and format pattern, so successful detection may require testing with known JSON files present on the system.

Useful 0 Not Useful 0

Impact Analysis

If you are using Rejetto HFS versions 3.0.0 through 3.2.0, this vulnerability could allow an attacker to access sensitive JSON files outside the intended shared directories.

While the impact is limited due to the narrow file naming and format constraints, unauthorized access to JSON files could still expose configuration details, user data, or other sensitive information stored in those files.

The CVSS v3.1 score of 5.3 (Medium) indicates that the vulnerability poses a risk of low confidentiality impact, with no integrity or availability impact.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially affect compliance with standards and regulations depending on the nature of the exposed data.

• GDPR: If the exposed JSON files contain personally identifiable information (PII) of EU citizens, unauthorized access could violate GDPR requirements for data protection and confidentiality.
• HIPAA: If the exposed files include protected health information (PHI), this could lead to non-compliance with HIPAA's safeguards for protecting sensitive patient data.

However, the limited scope of the vulnerability (only specific JSON files matching a narrow pattern) reduces the likelihood of a severe compliance violation unless those files contain highly sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate CVE-2026-61505, follow these immediate steps:

• Upgrade Rejetto HFS: Update to the latest version of Rejetto HFS that is not affected by this vulnerability. If a patch is not yet available, monitor the vendor's official channels for updates.
• Restrict access: Limit access to the HFS server to trusted networks or IP addresses only. Use firewalls or network security groups to block unauthorized access.
• Disable unnecessary features: If the 'lang' parameter is not required for your use case, consider disabling or removing it from the HFS configuration.
• Monitor for exploitation: Set up logging and monitoring to detect any attempts to exploit the path traversal vulnerability. Look for unusual requests targeting the 'lang' parameter.
• Review file permissions: Ensure that sensitive JSON files outside the shared folders are not accessible or have restricted permissions to minimize potential impact.

Useful 0 Not Useful 0