Unauthenticated Arbitrary File Access in HFS2

Executive Summary

CVE-2026-97360 is a critical unauthenticated arbitrary file access vulnerability in HFS2 versions 2.4.0 and earlier. It allows attackers to read, write, append, or delete files anywhere the HFS service account has filesystem access outside the shared folder. The flaw exists due to missing authorization checks in template macros and the path resolver's failure to confine absolute paths, enabling template engine manipulation.

Useful 0 Not Useful 0

Detection Guidance

Check if HFS2 version 2.4.0 or earlier is running. Inspect network traffic for template macro usage like {.load.}, {.save.}, {.append.}, or {.delete.} commands. Verify if unauthorized file operations occur outside the shared directory.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to complete compromise of the host system's confidentiality, integrity, and availability. Attackers can read sensitive files like system configurations, write malicious files to execute arbitrary code, append data to critical files, or delete important data. The impact is severe as it requires no authentication and affects all file operations outside the shared directory.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection standards like GDPR and HIPAA due to unauthorized file access and potential data breaches. It compromises confidentiality by allowing access to sensitive files and integrity by permitting unauthorized modifications. Organizations using affected HFS2 versions may face regulatory penalties and must address this flaw to maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict HFS2 to trusted networks, run it with minimal privileges, and remove unnecessary macros. Migrate to HFS 3.x if possible. Temporarily disable vulnerable template macros until patched.

Useful 0 Not Useful 0