CVE Watch—

CVE-2024-23692

Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

CVSS

—

No CVSS

EPSS

99.5%

p100

KEV

YES

Jul 9, 2024

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

99.5%EPSS · 30 days99.5%

2026-06-302026-07-16

KEV catalog record

Product

Rejetto / HTTP File Server

Vulnerability

Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

Added to KEV

Jul 9, 2024

Remediate by

Jul 30, 2024

Known ransomware use

Summary description

Rejetto HTTP File Server contains an improper neutralization of special elements used in a template engine vulnerability. This allows a remote, unauthenticated attacker to execute commands on the affected system by sending a specially crafted HTTP request.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

The patched Rejetto HTTP File Server (HFS) is version 3: https://github.com/rejetto/hfs?tab=readme-ov-file#installation, https://www.rejetto.com/hfs/ ; https://nvd.nist.gov/vuln/detail/CVE-2024-23692

Related CVEs

No related CVEs by CWE or product.