CVE-2026-61504 describes an XSS vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0. The issue arises from improper neutralization of input during web page generation, specifically the failure to escape file names in the fallback "basic" web listing, which can be triggered by the ?get=basic parameter. This allows an attacker with upload rights or anonymous access (if upload folders are open) to upload files with names containing malicious scripts that execute in the context of users viewing the listing page.

Successful exploitation allows execution of arbitrary scripts in the browsers of users who view the affected listing page. This can lead to session hijacking, defacement, or other client-side attacks. The vulnerability requires the attacker to have upload permissions or the server to have an open upload folder accessible anonymously. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict upload permissions to trusted users only and avoid enabling anonymous uploads. Consider disabling or restricting access to the fallback "basic" web listing feature if possible to reduce exposure.