Http File Server
Approved changes feed: RSS · Atom
cpe:2.3:a:rejetto:http_file_server:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Rejetto (fd662d82-f138-58a8-9f46-6277e2bad373) |
|---|---|
| Product | Http File Server (beabdb99-d6b6-5011-acab-33fea09d60d5) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:docker/rejetto/hfs |
purl2cpe | 2026-06-01 10:12:07.133268 |
pkg:github/drapid/hfs |
purl2cpe | 2026-06-01 10:12:07.133270 |
pkg:github/rejetto/hfs |
purl2cpe | 2026-06-01 10:12:07.133272 |
pkg:npm/hfs |
purl2cpe | 2026-06-01 10:12:07.133273 |
pkg:sourceforge/hfs |
purl2cpe | 2026-06-01 10:12:07.133275 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-39943 |
vulnerable | 2026-06-08 06:41:51.919485 |
Details available
CRITICAL (9.9)
rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).
Published: 2024-07-04T00:00:00.000Z
Updated: 2024-08-02T04:33:11.602Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-23692 |
vulnerable | 2026-06-08 06:29:40.272556 |
Rejetto HTTP File Server 2.3m Unauthenticated RCE
CRITICAL (9.8)
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.
Published: 2024-05-31T09:36:28.763Z
Updated: 2026-08-11T03:55:27.853Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-1227 |
vulnerable | 2026-06-08 06:25:39.612003 |
Multiple vulnerabilities in Rejetto's Http File Server
MEDIUM (6.5)
An open redirect vulnerability, the exploitation of which could allow an attacker to create a custom URL and redirect a legitimate page to a malicious site.
Published: 2024-03-12T15:11:26.293Z
Updated: 2024-08-02T17:02:56.714Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-1226 |
vulnerable | 2026-06-08 06:25:39.611465 |
Multiple vulnerabilities in Rejetto's Http File Server
HIGH (7.5)
The software does not neutralize or incorrectly neutralizes certain characters before the data is included in outgoing HTTP headers. The inclusion of invalidated data in an HTTP header allows an attacker to specify the full HTTP response represented by the browser. An attacker could control the response and craft attacks such as cross-site scripting and cache poisoning attacks.
Published: 2024-03-12T15:07:18.532Z
Updated: 2024-08-05T17:48:59.065Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-7226 |
vulnerable | 2026-06-08 05:05:59.009679 |
Details available
The file comment feature in Rejetto HTTP File Server (hfs) 2.3c and earlier allows remote attackers to execute arbitrary code by uploading a file with certain invalid UTF-8 byte sequences that are interpreted as executable macro symbols.
Published: 2014-10-10T01:00:00.000Z
Updated: 2024-08-06T12:40:19.268Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-6287 |
vulnerable | 2026-06-08 05:05:57.321963 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.