CVE-2026-97359

{
  "etk_id": "ETK-2026-601",
  "cve_id": "CVE-2026-97359",
  "display_id": "CVE-2026-97359",
  "ghsa_id": "GHSA-2w8r-rhgc-4pch",
  "euvd_id": "EUVD-2026-85879",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Template injection in rejetto hfs2 upload handling",
  "summary": "Rejetto hfs2 versions 2.4.0 and earlier are affected by template injection during multipart file uploads. An unauthenticated remote attacker who can submit an upload may execute commands on the host.",
  "mitigation": "Disable unauthenticated uploads or restrict upload access to trusted users and networks. Limit public exposure of affected hfs2 instances; no fixed release is recorded.",
  "vendor": "rejetto",
  "product": "hfs2",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.0.0, <= 2.4.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "hfs2",
      "purl": null
    }
  ],
  "cwes": [
    1336
  ],
  "cvss_score": 10,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
  "epss_score": 0.0078,
  "epss_percentile": 0.5515,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 112.86964403333333,
  "t0_at": "2026-09-24T13:28:18.818000+00:00",
  "signals": {
    "kev": {
      "at": "2026-10-03T00:00:00+00:00",
      "days": 9,
      "is_lower_bound": false,
      "measured_at": "2026-09-24T13:28:18.818000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-97359"
    },
    "public_poc": {
      "at": "2026-09-24T13:28:18.818000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-24T13:28:18.818000+00:00",
      "url": "https://github.com/wgetnz/hfs2/blob/master/advisories/hfs2-upload-filename-template-injection/README.md"
    },
    "trigger_signal": {
      "at": "2026-10-03T00:00:00+00:00",
      "days": 8.438671087962963,
      "is_lower_bound": false,
      "measured_at": "2026-09-24T13:28:18.818000+00:00",
      "url": "https://vulncheck.com/cve/CVE-2026-97359"
    }
  }
}