CVE-2026-97359 — HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection
HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution…
Published: 2026-09-24 · CVSS: 10.0 · CVSS 4.0
HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template quoting sequence followed by an exec macro, which bypasses the authorization check in the dispatcher to execute arbitrary commands on the underlying host system.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7