---
schema: 1
kind: vulnerability
title: "CVE-2026-61500 — Rejetto HFS < 3.2.1: predictable session-signing PRNG lets an unauthenticated attacker forge admin sessions to RCE (CVSS 9.3)"
headline: "Rejetto HFS patches a six-CVE chain whose pre-auth session forgery reaches code execution on any exposed instance"
summary: >
  Rejetto HFS (HTTP File Server) 3.0.0–3.2.0 derives its session-cookie signing key from JavaScript's
  Math.random() and leaks that generator's outputs to unauthenticated clients, letting an attacker forge an
  administrator session and reach RCE via the server_code feature (CVE-2026-61500, CVSS 9.3). Fixed in 3.2.1
  (2026-07-13) alongside five companion bugs; no exploitation reported yet, but a pre-auth RCE in
  internet-facing file-sharing software warrants prompt patching of any exposed instance.
discovered_at: "2026-07-13T20:33:00Z"
event_date: "2026-07-13"
run_id: 2026-07-13T2009Z-intel
priority: notable
immediate_action: null
tags: [vulnerabilities, rce, pre-auth, auth-bypass, path-traversal, patch-available]
regions: [global]
sectors: [technology]
entities: []
techniques: [T1190, T1059]
affected_products: ["Rejetto HFS"]
cves:
  - id: CVE-2026-61500
    cvss: "9.3"
    epss: null
    type: auth-bypass
    vector: zero-click
    auth: pre-auth
    status: [patch-available]
    affected: "3.0.0 – 3.2.0"
    fixed: "3.2.1"
  - id: CVE-2026-61501
    cvss: "5.3"
    epss: null
    type: xss
    vector: user-interaction
    auth: pre-auth
    status: [patch-available]
    affected: "3.0.0 – 3.2.0"
    fixed: "3.2.1"
  - id: CVE-2026-61502
    cvss: "5.1"
    epss: null
    type: logic-flaw
    vector: user-interaction
    auth: pre-auth
    status: [patch-available]
    affected: "3.0.0 – 3.2.0"
    fixed: "3.2.1"
  - id: CVE-2026-61503
    cvss: "6.9"
    epss: null
    type: info-disclosure
    vector: zero-click
    auth: pre-auth
    status: [patch-available]
    affected: "3.0.0 – 3.2.0"
    fixed: "3.2.1"
  - id: CVE-2026-61504
    cvss: "5.1"
    epss: null
    type: xss
    vector: user-interaction
    auth: pre-auth
    status: [patch-available]
    affected: "3.0.0 – 3.2.0"
    fixed: "3.2.1"
  - id: CVE-2026-61505
    cvss: "6.9"
    epss: null
    type: path-traversal
    vector: zero-click
    auth: pre-auth
    status: [patch-available]
    affected: "3.0.0 – 3.2.0"
    fixed: "3.2.1"
sources:
  - url: "https://www.vulncheck.com/advisories/rejetto-hfs-session-forgery-via-predictable-signing-key"
    publisher: "VulnCheck"
    date: "2026-07-13"
    role: primary
  - url: "https://github.com/rejetto/hfs/releases/tag/v3.2.1"
    publisher: "Rejetto (GitHub release)"
    date: "2026-07-13"
    role: corroborating
closed_sources: []
evidence:
  - quote: "Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login."
    publisher: "VulnCheck"
  - quote: "A remote attacker can collect a small number of login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature."
    publisher: "VulnCheck"
verification: multi-source
sourcing_note: "CVE-2026-61500 detail and exploitation assessment from VulnCheck's advisory (finder Zach Hanley, Horizon3.ai); the five companion CVE ids and descriptions were verified against NVD; the 3.2.1 fix is confirmed by Rejetto's own GitHub release."
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: B
  credibility: 2
watchlist_hit: false
actions:
  - "Upgrade any internet-exposed Rejetto HFS to 3.2.1; where an immediate upgrade is not possible, take the admin interface off the public internet and disable the server_code feature — it is the code-execution sink the forged-session chain reaches."
migrated_from: null
---

VulnCheck disclosed a six-CVE chain in Rejetto HFS (HTTP File Server) 3.0.0 through 3.2.0, all fixed in 3.2.1 on 2026-07-13 ([VulnCheck, 2026-07-13](https://www.vulncheck.com/advisories/rejetto-hfs-session-forgery-via-predictable-signing-key)). The headline flaw, CVE-2026-61500 (CVSS 4.0 9.3, CWE-338 weak PRNG), derives the session-cookie signing key from JavaScript's non-cryptographic `Math.random()` and leaks outputs of that same generator to unauthenticated clients on the login endpoint; an attacker who collects a small number of login responses can reconstruct the generator's internal state, recover the signing key and forge a valid administrator session cookie — reaching full admin access and code execution through HFS's built-in `server_code` configuration feature (arbitrary server-side script), with no authentication or user interaction ([VulnCheck, 2026-07-13](https://www.vulncheck.com/advisories/rejetto-hfs-session-forgery-via-predictable-signing-key)). Five companion bugs, all verified on NVD and fixed in the same 3.2.1 release, lower the bar further: unauthenticated username enumeration including the default admin account (CVE-2026-61503), state-changing admin actions accepted over GET with no anti-CSRF check (CVE-2026-61502), stored XSS rendered when an admin views the log via a crafted failed-login username (CVE-2026-61501) and via unescaped filenames in the fallback "basic" listing reachable by anonymous uploaders (CVE-2026-61504), and a `lang`-parameter path traversal limited to reading specific JSON files outside shared folders (CVE-2026-61505). No in-the-wild exploitation of this 3.x chain has been reported yet; the risk is the standard one for a pre-auth, unauthenticated-RCE flaw in internet-facing file-sharing software whose patch is already public — once the forge-the-cookie technique is understood, an exposed instance is a low-effort opportunistic target.

**Defender takeaway:** treat any internet-reachable HFS instance as exposed the moment a public write-up appears — the exploitation primitive is a forged admin cookie, not a memory-corruption craft, so weaponisation is cheap. In HFS request logs, the recovery-then-forge sequence shows as a short burst of repeated login requests from one source immediately followed by an authenticated, admin-privileged session with no preceding legitimate credential-setting event, then privileged actions such as `server_code` edits or account creation from that session. **Triage:** a genuine admin login issues a `Set-Cookie` from the server before any privileged action; a forged session presents a valid-looking admin cookie the server never issued and is typically preceded by a cluster of login probes used to recover the generator state — either signal alone is weak, the sequence is the tell. Hardening: upgrade to 3.2.1; if that must wait, keep the admin interface off the public internet and disable `server_code`.