CVE-2026-97359: HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection
HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template quoting sequence followed by an exec macro, which bypasses the authorization check in the dispatcher to execute arbitrary commands on the underlying host system.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Rejetto HFS2 version 2.4.0 and earlier are affected where an attacker can reach the multipart upload handler over the network. The issue is exploitable without authentication or user interaction.
What does an attacker need to exploit this issue?
An attacker needs to submit a multipart upload with a crafted filename containing a closing template quoting sequence followed by an exec macro. No privileges are required.
What is the impact of successful exploitation?
Successful exploitation bypasses the dispatcher's authorization check and permits execution of arbitrary commands on the underlying host system. This can affect confidentiality, integrity, and availability.