Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Rejetto HFS admin log viewer can run malicious code

CVE-2026-61501 · published 3 months ago
Summary

Rejetto HFS versions 3.0.0 through 3.2.0 display log entries without cleaning them. An attacker can place specially crafted text in a failed login attempt, which then runs JavaScript in an administrator's browser when the logs are opened, potentially letting the attacker create accounts or run commands with admin rights. Update to a newer version or restrict access to the admin panel until the fix is applied.

What to do
  • Update rejetto hfs to version 3.2.1 or later.
Affected software
VendorProductAffected versions
rejetto hfs < 3.2.1
Original advisory text
Rejetto HFS < 3.2.1 Stored XSS in Admin Log Viewer
Rejetto HFS 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote unauthenticated attacker can submit a failed login with a crafted username that is written to the error log and executes JavaScript in an administrator's browser when the logs are viewed, allowing the attacker to create accounts or execute code on the server with the administrator's privileges.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published13 Jul 2026
Updated4 Nov 2026
First seen13 Jul 2026
Sources
CVE-2026-61501 · NVD
CVE-2026-61501 · MITRE
CVE-2026-61501 · OSV
Track software like this
Free during beta