Unauthenticated Arbitrary File Access in HFS2

HFS2 (HTTP File Server 2) version 2.4.0 and earlier contains a critical unauthenticated arbitrary file access vulnerability tracked as CVE-2026-97360. The vulnerability stems from a fundamental design flaw where the application's macro dispatcher lacks an authorization model, and the path resolver fails to properly constrain file operations to the intended shared directory. This combination allows unauthenticated remote attackers to perform arbitrary file read, write, append, and delete operations on the host filesystem.

Because these operations are executed with the privileges of the HFS2 service account, a successful exploitation allows an attacker to manipulate application templates or configuration files, potentially leading to full compromise of the host system. Given the nature of the flaw, which allows for both reading sensitive data and overwriting system files, this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the host platform. Users are advised to review the vendor's guidance for updates to address these architectural deficiencies.

Impact

Successful exploitation allows for full system file manipulation within the security context of the HFS2 service. An attacker could exfiltrate sensitive configuration files, modify application logic to achieve remote code execution, or delete critical system files, potentially leading to a complete service disruption or host takeover. This affects any deployment of HFS2 2.4.0 or earlier regardless of the underlying host operating system.

Recommendation

Prioritize the identification and patching of all HFS2 instances. If an immediate upgrade is not possible, restrict network access to the HFS2 management interface to trusted segments only, as the vulnerability does not require authentication. Monitor webserver logs for unexpected requests involving path traversal or directory navigation sequences targeting HFS2 endpoints.