CVE-2026-61505 — Rejetto HFS < 3.2.1 Limited File Disclosure via Path Traversal in lang Parameter
Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthenticated attacker to read certain JSON files outside the share…
Published: 2026-07-13 · CVSS: 6.9 · CVSS 4.0
Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthenticated attacker to read certain JSON files outside the shared folders. Exploitation is constrained to files matching a narrow naming and format pattern, limiting practical impact.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7