CyberRota Analysis
AI-GeneratedRejetto HFS versions 3.0.0 to 3.2.0 are vulnerable to a path traversal attack via the lang query parameter, enabling remote unauthenticated attackers to access specific JSON files outside designated shared folders. While the exploitation is limited to files with specific naming and formatting patterns, organizations using these versions should prioritize patching to mitigate potential data exposure risks. Users of affected HFS versions should assess their exposure and apply necessary updates promptly.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthenticated attacker to read certain JSON files outside the shared folders. Exploitation is constrained to files matching a narrow naming and format pattern, limiting practical impact.