Act nowDisclosed

Advisory · CVE-2026-97359

Unauthenticated remote code execution in HFS2 via filename template injection

HFS2 2.4.0 and earlier lets an unauthenticated attacker embed template syntax in an uploaded filename, bypass the dispatcher authorization check, and execute arbitrary commands on the host with a crafted exec macro.

Advisory published September 24, 2026Independent summary
Vendor
rejetto
Product
HFS2
Identifier / CWE
CVE-2026-97359
CWE-1336
Action timing
Immediate
ELI5

Explain it like I’m five

HFS2 lets visitors upload files, and it decorates filenames with a template system. An attacker puts a secret instruction inside the filename itself, which tricks the template into unlocking a command door that was supposed to stay locked, and runs their commands on the computer.

SIMPLIFIED_ATTACK_PATH05 STEPS
  1. 01Multipart upload

    An unauthenticated attacker sends a multipart upload to HFS2 with a filename containing malicious template syntax.

  2. 02Template parsing

    The upload handler parses the filename as a template instead of treating it as plain text.

  3. 03Exec macro

    The filename includes a closing template quoting sequence followed by an exec macro.

  4. 04Authorization bypass

    The injected macro bypasses the authorization check in the dispatcher.

  5. 05Command execution

    The attacker-controlled command runs on the underlying host system.

What happened

HFS2 versions 2.0.0 through 2.4.0 contain a template injection vulnerability in the multipart upload handler, disclosed on September 24, 2026. The handler parses an uploaded filename as template syntax instead of treating it as an opaque string. An unauthenticated attacker can craft a filename containing a closing template quoting sequence followed by an exec macro; the injected macro bypasses the authorization check in the dispatcher and executes arbitrary commands on the underlying host system. The issue is rated critical at CVSS 10.0.

This is the same class of bug that made the original HFS file server a favorite exploitation target in the past: an unauthenticated, network-reachable path straight to code execution.

What to do

  1. Inventory any systems running HFS2, including internal file-sharing instances and test deployments.
  2. Treat HFS2 2.0.0 through 2.4.0 as affected and upgrade to a fixed release using the project release guidance.
  3. Restrict network access to HFS2 instances, especially the upload endpoints, until patched.
  4. Review upload logs and server process activity for filenames containing template quoting sequences or exec macros.
  5. Check affected hosts for follow-on activity: new accounts, scheduled tasks, unexpected outbound connections, and modified binaries.
  6. Consider the host fully compromised if the upload endpoint was exposed to untrusted users before patching.

Management note

A CVSS 10.0 unauthenticated RCE in a file server is a straight line from internet scanning to host compromise. The predecessor project in this family has a history of mass exploitation, so assume scanners already know about this one. Patching is the fix; exposure review and host forensics are the follow-through.