Vulnerability Description
HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template quoting sequence followed by an exec macro, which bypasses the authorization check in the dispatcher to execute arbitrary commands on the underlying host system.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/wgetnz/hfs2/blob/master/advisories/hfs2-upload-filename-templ
- https://www.vulncheck.com/advisories/hfs2-rce-via-multipart-upload-filename-temp
- https://github.com/wgetnz/hfs2/blob/master/advisories/hfs2-upload-filename-templ
FAQ
What is CVE-2026-97359?
CVE-2026-97359 is a vulnerability with a CVSS score of 10.0 (CRITICAL). HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious...
How severe is CVE-2026-97359?
CVE-2026-97359 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-97359?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.