CVE-2026-61504 is a cross-site scripting vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0. The vulnerability arises from improper neutralization of input during web page generation: specifically, file names are not escaped in the fallback "basic" web listing. This listing can be forced by any browser using the ?get=basic parameter. An attacker who can upload files (or an anonymous user if the upload folder is open) can craft a file name containing script code that executes in the context of users viewing the listing, leading to XSS.

Successful exploitation allows execution of arbitrary script code in the browsers of users viewing the affected file listing. This can lead to theft of user credentials, session hijacking, or other malicious actions performed in the context of the vulnerable web application. The vulnerability requires upload permissions or an open upload folder accessible to anonymous users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict upload permissions to trusted users only and avoid enabling open upload folders accessible to anonymous users. Users should avoid using the fallback "basic" listing (?get=basic) if possible.