CVE-2026-61501 | THREATINT

Description

Rejetto HFS 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote unauthenticated attacker can submit a failed login with a crafted username that is written to the error log and executes JavaScript in an administrator's browser when the logs are viewed, allowing the attacker to create accounts or execute code on the server with the administrator's privileges.

PUBLISHED Reserved 2026-07-10 | Published 2026-07-13 | Updated 2026-07-14 | Assigner VulnCheck

MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

MEDIUM: 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Problem types

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Default status

affected

3.0.0 (semver) before 3.2.1

affected

Credits

Zach Hanley (@hacks_zach) of Horizon3.ai, in collaboration with Claude and Anthropic Research finder

References

github.com/rejetto/hfs/releases/tag/v3.2.1 (hfs v3.2.1 Release Notes) release-notes patch

www.vulncheck.com/...etto-hfs-stored-xss-in-admin-log-viewer third-party-advisory

cve.org (CVE-2026-61501)

nvd.nist.gov (CVE-2026-61501)

Download JSON