CVE-2026-97359: Rejetto HFS2

Critical severity, CVSS 10.0. EPSS: 0.8% chance of exploitation in the next 30 days.

HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template quoting sequence followed by an exec macro, which bypasses the authorization check in the dispatcher to execute arbitrary commands on the underlying host system.

Affected products

• Rejetto HFS2: from 2.0.0, up to and including 2.4.0

Published 2026-09-24. Last modified 2026-09-29.