CVE-2026-61502 Rejetto HFS < 3.2.1 Cross-Site Request Forgery via GET Requests
Remote attackers can execute administrative actions and code by tricking admins into visiting crafted URLs or exploiting local access on default installations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-61502?
CVE-2026-61502 is a medium-severity vulnerability in rejetto hfs, published on 13 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution - by causing a logged-in administrator's browser to navigate to a crafted URL, or without any credentials against default installations when the attack originates from the server's own machine.
Weakness: CWE-352
Which versions are affected by CVE-2026-61502?
How do I fix CVE-2026-61502?
No fix has been published for CVE-2026-61502 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-61502 being exploited?
There is no known exploitation of CVE-2026-61502 in the wild and no public exploit code.
Sources
Also known as GHSA-53v3-qjv8-5264.