Risk Letters

Exploited vulnerability

CVE-2026-97359

TLP:CLEAR

Rejetto hfs2 Improper Neutralization of Special Elements Used in a Template Engine

HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template quoting sequence followed by an exec macro, which bypasses the authorization check in the dispatcher to exe

Facts

  • Vendor: Rejetto
  • Product: HFS2
  • CVSS: 10
  • EPSS (probability of exploitation within 30 days): 5.5 %
  • First known exploitation: 3 October 2026
  • First seen by Risk Letters: 24 September 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD