CVE-2026-61505 Rejetto HFS < 3.2.1 Limited File Disclosure via Path Traversal in lang Parameter
Remote attackers can read specific JSON files outside shared folders via path traversal in the lang parameter of Rejetto HFS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-61505?
CVE-2026-61505 is a medium-severity path traversal vulnerability in rejetto hfs, published on 13 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthenticated attacker to read certain JSON files outside the shared folders. Exploitation is constrained to files matching a narrow naming and format pattern, limiting practical impact.
Weakness: CWE-22
Which versions are affected by CVE-2026-61505?
How do I fix CVE-2026-61505?
No fix has been published for CVE-2026-61505 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-61505 being exploited?
There is no known exploitation of CVE-2026-61505 in the wild and no public exploit code.
Sources
Also known as GHSA-2jh3-2rfc-9fhf.