Template Injection in HFS2 Leading to Remote Code Execution

Executive Summary

CVE-2026-97359 is a critical remote code execution (RCE) vulnerability in HFS2 versions 2.4.0 and earlier. It allows unauthenticated attackers to execute arbitrary commands on the host system by embedding malicious template syntax in a filename during a multipart upload. The attack bypasses authorization checks by using a closing template quoting sequence followed by an exec macro.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system is running HFS2 version 2.4.0 or earlier. You can verify the version by inspecting the server response headers or application metadata. Additionally, monitor network traffic for multipart upload requests containing filenames with template syntax like %item-resource% or {:} followed by {.exec|...} macros.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to take full control of the affected system without authentication. They can execute any command, steal data, install malware, or disrupt services. Since it affects the multipart upload handler, even failed upload attempts can trigger the exploit.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and system security in standards like GDPR and HIPAA. It enables unauthorized access and potential data breaches, which are major compliance violations. Organizations using vulnerable HFS2 versions risk fines and legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade HFS2 to a patched version if available. If upgrading is not possible, restrict HFS2 to trusted networks, filter malicious characters in the multipart filename parameter, run the service under a restricted account, and disable anonymous write permissions if uploads are unnecessary. Consider disabling the service entirely if not required.

Useful 0 Not Useful 0