CVE-2026-61505 describes a path traversal vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0. The vulnerability arises from improper limitation of the pathname in the lang query parameter, enabling remote unauthenticated attackers to access JSON files outside the shared folders. The scope of accessible files is constrained by a narrow naming and format pattern, limiting the extent of unauthorized file disclosure. No official patch or remediation level has been provided as of the published date, and no known exploits are reported in the wild.

An attacker can remotely read certain JSON files outside the intended shared directories without authentication. The impact is limited due to constraints on the file naming and format, reducing the risk of broad sensitive data exposure. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected Rejetto HFS versions and monitor for unusual access patterns to JSON files. Consider disabling or filtering the lang query parameter if feasible to reduce exposure.