PatchSiren cyber security CVE debrief
CVE-2026-61502 rejetto CVE debrief
Rejetto HFS 3.0.0 through 3.2.0 is vulnerable to Cross-Site Request Forgery via GET requests. This allows remote attackers to perform administrative actions, including account creation and configuration changes, potentially leading to code execution. The attack can be carried out by causing a logged-in administrator's browser to navigate to a crafted URL or without credentials against default installations when the attack originates from the server's own machine.
- Vendor
- rejetto
- Product
- hfs
- CVSS
- MEDIUM 5.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-13
- Original CVE updated
- 2026-07-13
- Advisory published
- 2026-07-13
- Advisory updated
- 2026-07-13
Who should care
Administrators and users of Rejetto HFS 3.0.0 through 3.2.0 should be aware of this vulnerability and take immediate action to secure their installations. This vulnerability could allow attackers to perform unauthorized administrative actions, potentially leading to code execution.
Technical summary
The Rejetto HFS (HTTP File Server) versions 3.0.0 through 3.2.0 are vulnerable to Cross-Site Request Forgery (CSRF) attacks via GET requests. The server exempts GET requests from its anti-CSRF header check, allowing attackers to perform state-changing API requests. This can lead to various administrative actions, including account creation and configuration changes, which could result in code execution. The vulnerability can be exploited in two scenarios: 1) By causing a logged-in administrator's browser to navigate to a crafted URL, or 2) Without any credentials against default installations when the attack originates from the server's own machine.
Defensive priority
High
Recommended defensive actions
- Update Rejetto HFS to version 3.2.1 or later
- Implement proper CSRF protection for all API requests
- Restrict administrative access to trusted IP addresses
- Monitor server logs for suspicious API requests
- Educate administrators about the risks of navigating to untrusted URLs while logged in
Evidence notes
The CVE record was published on 2026-07-13T18:16:30.173Z and was last modified on 2026-07-13T19:28:49.830Z. The NVD entry is currently Deferred. Limited details are available about the specific exploits or attacks related to this vulnerability.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-13T18:16:30.173Z and has not been modified since then. The NVD entry is currently Deferred.