Rejetto HFS versions 3.0.0 through 3.2.0 improperly neutralize input during web page generation in the administration panel by rendering log entries as HTML without sanitization. An unauthenticated remote attacker can submit a failed login attempt with a specially crafted username that is logged and subsequently executed as JavaScript in the administrator's browser when viewing the logs. This cross-site scripting vulnerability allows the attacker to perform actions such as creating accounts or executing code on the server with the administrator's privileges. The CVSS 4.0 base score is 5.3, indicating medium severity. No vendor advisory or patch information is available at this time.

Successful exploitation allows remote unauthenticated attackers to execute arbitrary JavaScript in the context of the administrator's browser. This can lead to unauthorized account creation or execution of code on the server with administrator privileges, potentially compromising the entire system. The vulnerability affects the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid viewing untrusted log entries or restrict access to the administration panel to trusted users only. Implementing additional input sanitization or filtering on log data may reduce risk but is not a substitute for an official fix.