CVE-2026-61502

MEDIUM 4.3

Rejetto HFS < 3.2.1 Cross-Site Request Forgery via GET Requests

CVSS Score

4.3

EPSS Score

0.2%

EPSS Percentile

8th

Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution - by causing a logged-in administrator's browser to navigate to a crafted URL, or without any credentials against default installations when the attack originates from the server's own machine.

CWE	CWE-352
Vendor	rejetto
Product	hfs
Published	Jul 13, 2026
Last Updated	Jul 14, 2026

Stay Ahead of the Next One

Get instant alerts for rejetto hfs

Be the first to know when new medium vulnerabilities affecting rejetto hfs are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

rejetto / hfs

3.0.0 < 3.2.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/rejetto/hfs/releases/tag/v3.2.1 vulncheck.com: https://www.vulncheck.com/advisories/rejetto-hfs-cross-site-request-forgery-via-get-requests

Credits

Zach Hanley (@hacks_zach) of Horizon3.ai, in collaboration with Claude and Anthropic Research