CVE-2026-97360
HFS2 2.4.0 Unauthenticated Arbitrary File Read/Write via Template Engine
- State
- Published
- Severity
- 10.0 Critical
- Published
- Sep 24, 2026
- Updated
- Sep 24, 2026
- Reserved
- Sep 24, 2026
Description
HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside the shared folder. Attackers can exploit the macro dispatcher's lack of authorization model combined with the path resolver's failure to confine absolute paths to manipulate the template engine and compromise the confidentiality, integrity, and availability of the host.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 10.0 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H | VulnCheck |
| 3.1 | 10.0 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
hfs2rejetto |
|
References
- https://github.com/wgetnz/hfs2/blob/master/advisories/hfs2-template-macro-missing-authorization/README.mdtechnical-descriptionexploit
- VulnCheck Advisorythird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.