CVE-2026-61505CWE-22path-traversal

CVE-2026-61505

Medium · published July 13, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
43.5
In the wild
Unconfirmed
What it is

Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthenticated attacker to read certain JSON files outside the shared folders. Exploitation is constrained to files matching a narrow naming and format pattern, limiting practical impact.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00522 · 43.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-07-13T22:16Z
References (2)
https://github.com/rejetto/hfs/releases/tag/v3.2.1 · [email protected]https://www.vulncheck.com/advisories/rejetto-hfs-limited-file-disclosure-via-path-traversal-in-lang-parameter · [email protected]
EPSS history
Timeline
  • 13 JUL 17:23Z
    Rejetto HFS < 3.2.1 Limited File Disclosure via Path Traversal in lang Parameter
    cvelistv5