Vulnerability · Published Sep 24, 2026 · Assigned by VulnCheck

CVE-2026-97360HFS2 2.4.0 Unauthenticated Arbitrary File Read/Write via Template Engine

Critical 10.0

In plain English

A critical-severity missing authorization in hfs2 from rejetto. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)0.4%top 61.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside the shared folder. Attackers can exploit the macro dispatcher's lack of authorization model combined with the path resolver's failure to confine absolute paths to manipulate the template engine and compromise the confidentiality, integrity, and availability of the host.

Affected products (as reported)

Vendor	Product	Versions
rejetto	hfs2	2.0.0 – through 2.4.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/wgetnz/hfs2/blob/master/advisories/hfs2-template-macro-missing-authorization/README.md technical-description, exploit
VulnCheck Advisory third-party-advisory