CVE-2026-61502 rejetto CVE debrief

Who should care

Administrators and users of Rejetto HFS 3.0.0 through 3.2.0 should be aware of this vulnerability and take immediate action to secure their installations. This vulnerability could allow attackers to perform unauthorized administrative actions, potentially leading to code execution.

Technical summary

The Rejetto HFS (HTTP File Server) versions 3.0.0 through 3.2.0 are vulnerable to Cross-Site Request Forgery (CSRF) attacks via GET requests. The server exempts GET requests from its anti-CSRF header check, allowing attackers to perform state-changing API requests. This can lead to various administrative actions, including account creation and configuration changes, which could result in code execution. The vulnerability can be exploited in two scenarios: 1) By causing a logged-in administrator's browser to navigate to a crafted URL, or 2) Without any credentials against default installations when the attack originates from the server's own machine.

Defensive priority

High

Recommended defensive actions

• Update Rejetto HFS to version 3.2.1 or later
• Implement proper CSRF protection for all API requests
• Restrict administrative access to trusted IP addresses
• Monitor server logs for suspicious API requests
• Educate administrators about the risks of navigating to untrusted URLs while logged in

Evidence notes

The CVE record was published on 2026-07-13T18:16:30.173Z and was last modified on 2026-07-13T19:28:49.830Z. The NVD entry is currently Deferred. Limited details are available about the specific exploits or attacks related to this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.