CVE-2026-61504

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-61504
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61504.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-61504
Published
2026-07-13T17:23:40Z
Modified
2026-08-12T03:51:37Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Rejetto HFS < 3.2.1 Stored XSS via File Names in Basic Web Listing
Details

Rejetto HFS 3.0.0 through 3.2.0 does not escape file names in its fallback "basic" web listing, and this listing can be forced by any browser via the ?get=basic parameter. A user with upload permission - or an anonymous user on servers with an open upload folder - can store a file whose name contains script that executes in the browser of anyone viewing the listing.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61504.json"
}
References

Affected packages

Git / github.com/rejetto/hfs

Affected ranges

Type
GIT
Repo
https://github.com/rejetto/hfs
Events
Introduced
72b005c14cd3d11e0ef3afa3c9fa46bc07af444a
Fixed
15f0eb32f856016b6a3a04c8679b9a12eb18c203
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.2.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.0.7
v3.1.0
v3.1.0-alpha1
v3.1.0-alpha3
v3.1.0-beta4
v3.1.0-beta5
v3.1.0-beta6
v3.1.0-rc10
v3.1.0-rc11
v3.1.0-rc12
v3.1.0-rc7
v3.1.0-rc8
v3.1.0-rc9
v3.1.1
v3.1.2
v3.1.3
v3.1.4
v3.1.5
v3.1.7
v3.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61504.json"