{"id":"CVE-2026-97359","published":"2026-09-24T13:28:18Z","modified":"2026-09-29T02:44:54Z","title":"HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection","vendor":"rejetto","product":"hfs2","tier":"core","eol":null,"affectedVersions":[{"vendor":"rejetto","product":"hfs2","versions":[">= 2.0.0, <= 2.4.0"]}],"description":{"text":"HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template quoting sequence followed by an exec macro, which bypasses the authorization check in the dispatcher to execute arbitrary commands on the underlying host system.","provenance":"source","from":"CVE.org"},"summary":{"text":"A template injection flaw in the multipart upload handler of rejetto's HFS2 (HTTP File Server) 2.4.0 and earlier lets an attacker submit a filename with embedded template syntax that is evaluated as code. An unauthenticated remote attacker needs only network access to the server and no user interaction to exploit it, and can use it to run arbitrary commands on the underlying host.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:54:00Z"},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.05516,"percentile":0.92804,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-10-03","exploitedFirstSeen":null,"ransomware":false,"evidence":[],"evidenceTotal":0,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-1336","name":"Improper Neutralization of Special Elements Used in a Template Engine"}],"references":[{"url":"https://github.com/wgetnz/hfs2/blob/master/advisories/hfs2-upload-filename-template-injection/README.md","tags":["technical-description","exploit"]},{"url":"https://www.vulncheck.com/advisories/hfs2-rce-via-multipart-upload-filename-template-injection","tags":["third-party-advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-85879","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-85879","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2026-97359","name":"Rejetto HTTP File Server 2.4.x - Template Injection","severity":"critical","path":"http/cves/2026/CVE-2026-97359.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-97359.yaml"}],"provenance":"source"},"exploitRefs":["https://github.com/wgetnz/hfs2/blob/master/advisories/hfs2-upload-filename-template-injection/README.md"],"flow":[],"timeline":[{"date":"2026-09-24","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-97359","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":75.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 29 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.56,"detail":"percentile 0.9280"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}