Medium severity5.3NVD Advisory· Published Jul 13, 2026· Updated Jul 14, 2026
CVE-2026-61505
CVE-2026-61505
Description
Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthenticated attacker to read certain JSON files outside the shared folders. Exploitation is constrained to files matching a narrow naming and format pattern, limiting practical impact.
Affected products
1Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.