CVE-2026-97360 HFS2 2.4.0 Unauthenticated Arbitrary File Read/Write via Template Engine
Unauthenticated attackers can read, write, or delete arbitrary files on the host via path traversal in the template engine, compromising system integrity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-97360?
CVE-2026-97360 is a critical path traversal vulnerability in rejetto hfs2, published on 24 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside the shared folder. Attackers can exploit the macro dispatcher's lack of authorization model combined with the path resolver's failure to confine absolute paths to manipulate the template engine and compromise the confidentiality, integrity, and availability of the host.
Weakness: CWE-862
Which versions are affected by CVE-2026-97360?
How do I fix CVE-2026-97360?
No fix has been published for CVE-2026-97360 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-97360 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-97360 exists.
Sources
Also known as GHSA-3j4w-pf2p-gw5r.