CVE-2026-61505 describes a path traversal vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0. The vulnerability arises from improper limitation of the pathname in the lang query parameter, enabling remote unauthenticated attackers to access JSON files outside the shared folders. However, the attack surface is constrained by the requirement that the targeted files must conform to a narrow naming and format pattern, limiting the extent of unauthorized data exposure.

An attacker can remotely read certain JSON files outside the shared folder structure without authentication. Due to the limited file pattern constraints, the impact is reduced compared to unrestricted path traversal vulnerabilities. There is no indication of privilege escalation, code execution, or broader system compromise from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is documented at this time. Users should monitor vendor communications for updates and consider restricting access to sensitive JSON files or disabling the lang query parameter if feasible until a fix is available.