An unauthenticated remote code execution vulnerability exists in Rejetto HFS2 versions 2.4.0 and earlier, allowing attackers to execute arbitrary system commands via crafted multipart upload requests.

The application fails to sanitize the filename parameter during multipart file uploads before passing it to the template engine. An unauthenticated attacker can inject template macros, such as the exec macro, to bypass authorization checks and execute commands on the underlying host system with the privileges of the HFS process.

Successful exploitation of this vulnerability grants an attacker full remote code execution capabilities on the host server. This poses a critical risk to data confidentiality, integrity, and availability, as the attacker could exfiltrate sensitive files, install persistent backdoors, or pivot into the internal network. Given the CVSS score of 10.0, this represents the highest level of severity and requires immediate remediation to prevent total system compromise.

Immediate Action: Update Rejetto HFS2 to the latest patched version available from the vendor. If an update is not immediately possible, disable the file upload functionality to prevent exploitation.

Proactive Monitoring: Review web server and system access logs for anomalous POST requests containing template syntax such as curly braces, pipe characters, or exec macros in the filename field.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block multipart upload requests containing suspicious template injection patterns or non-standard characters in the filename field.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the research write-up by @wgetnz.

The severity of this vulnerability cannot be overstated, as it allows for trivial remote code execution without authentication. Organizations running Rejetto HFS2 must prioritize patching or disabling the affected upload functionality immediately. Relying solely on network-level controls is insufficient, and system administrators should verify their version and apply updates as a matter of urgency.