CVE-2026-97359 PUBLISHED

HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection

Assigner: VulnCheck
Reserved: 24.09.2026 Published: 24.09.2026 Updated: 24.09.2026

HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template quoting sequence followed by an exec macro, which bypasses the authorization check in the dispatcher to execute arbitrary commands on the underlying host system.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score: 10

Product Status

Vendor rejetto
Product hfs2
Versions Default: unaffected
  • affected from 2.0.0 to 2.4.0 (incl.)

Credits

  • wgetnz finder
  • VulnCheck coordinator

References

Problem Types

  • Improper Neutralization of Special Elements Used in a Template Engine CWE