A critical, unauthenticated arbitrary file access vulnerability in Rejetto HFS2 allows remote attackers to fully compromise the host filesystem and execute unauthorized file operations.

The vulnerability stems from a lack of authorization checks in the macro dispatcher combined with a flawed path resolver in uri2diskMaybe(). An unauthenticated attacker can supply absolute paths to file-related template macros, bypassing virtual filesystem constraints to access sensitive files anywhere the HFS service account has permission.

Successful exploitation grants an unauthenticated attacker the ability to read sensitive system files, overwrite configuration files, or delete critical data, leading to a complete compromise of system confidentiality, integrity, and availability. Given the CVSS score of 10.0, this vulnerability poses an extreme risk to business operations and data security, effectively allowing an attacker to gain full control over the host environment.

Immediate Action: There is no official patch currently available; users should immediately restrict access to the HFS2 instance by placing it behind a VPN or a trusted internal network, or migrate to the maintained HFS 3.x branch.

Proactive Monitoring: Review web access logs for unusual template macro usage, specifically looking for attempts to access absolute paths (e.g., C:\Windows\) or suspicious use of {.load.}, {.save.}, {.append.}, or {.delete.} macros.

Compensating Controls: Configure the HFS service to run under a restricted, low-privilege service account with filesystem permissions strictly limited to the intended share folder, preventing the application from modifying or reading files outside that directory even if compromised.

Public Exploit Available: Yes — a functional proof-of-concept exists as detailed in the technical write-up provided by the researcher at the referenced GitHub repository.

This vulnerability represents an absolute failure of access control and requires immediate intervention. Organizations currently utilizing HFS2 must treat this as a high-priority risk and implement the recommended network-level restrictions or migrate to a supported version immediately to prevent unauthorized system access and potential data exfiltration.