Skip to content
Threat Feed
Subscribe

Product

HTTP File Server (< 3.2.1)

1 brief RSS
critical advisory

Rejetto HFS Vulnerability Allows Remote Code Execution via Session Forgery (CVE-2026-61500)

A remote attacker can exploit a critical vulnerability, CVE-2026-61500, in Rejetto HFS versions 3.0.0 through 3.2.0 by recovering the session-cookie signing key due to poor randomness, forging an administrator session, and achieving remote code execution.

HFS +1 web-vulnerability rce session-hijacking
4t 1c updated