CVE-2026-97359 is a critical (CVSS 10.0) template injection flaw in HFS2 versions 2.0.0 through 2.4.0. An unauthenticated attacker can run arbitrary commands on the host by uploading a file with a crafted filename.
What Is It
The flaw is in HFS2's multipart upload handler, and it is classified as CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine). According to the NVD description, an attacker can put template syntax in an uploaded file's name. The filename closes the template's quoting sequence and then adds an exec macro. This gets past the authorization check in the dispatcher and runs arbitrary commands on the underlying host.
VulnCheck published the CVE on 2026-09-24. NVD currently lists its status as "Deferred."
Why It Matters
VulnCheck scores this CVE at the maximum severity under both CVSS versions:
- CVSS 3.1: 10.0 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 10.0 CRITICAL
The attack works over the network with low complexity. It needs no privileges and no user interaction. Under CVSS 3.1 the scope is Changed, so the impact reaches beyond the vulnerable component to the host system. Confidentiality, integrity and availability impacts are all rated High.
The supplied data has no CISA KEV entry for this CVE, so active exploitation is not confirmed through KEV at this time.
What's Vulnerable
- Vendor: rejetto
- Product: HFS2 (
pkg:github/rejetto/hfs2) - Affected versions: 2.0.0 through 2.4.0, inclusive
- Repository: https://github.com/rejetto/hfs2
The CVE record carries the unsupported-when-assigned tag. This means the affected product was no longer supported by its maintainer when the CVE was assigned.
Patch Status
The supplied KEV and NVD data does not name a fixed version or an official patch. There is also no CISA required action or due date, because the KEV entry is empty. Since the product is flagged as unsupported, a vendor fix may never come. Anyone running HFS2 versions 2.0.0 through 2.4.0 should check the referenced advisories for guidance. They should also decide whether internet-facing instances with upload enabled should stay in service at all.