What happened
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (HFS or HttpFileServer) allows remote attackers to execute arbitrary programs.
Affected versions
HTTP File Server (HFS): See original advisory Fixed: See vendor advisory.
Why it matters
This source correlation may provide earlier visibility while structured CVE metadata is still being updated.
Detection & mitigation
- Review the original advisory and validate affected versions.
- Apply vendor-provided updates or mitigations when available.
Public PoC references
RepositoryAuthorFirst seenReference
Exploit-DB 34926Rejetto HTTP File Server (HFS) - Remote Command Execution (Metasploit)Metasploit2014-10-09VerifiedExploit-DB 34668Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution (1)Daniele Linguaglossa2014-09-15VerifiedExploit-DB 39161Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution (2)Avinash Thapa2016-01-04VerifiedExploit-DB 49125Rejetto HttpFileServer 2.3.x - Remote Command Execution (3)Óscar Andreu2020-11-30VerifiedSploitusRemote command execution in Rejetto HttpFileServer 2.3.x via search function payload injection.KitPloit2026-10-20T06:21:57Candidatekitploit.comRemote command execution in Rejetto HttpFileServer 2.3.x via search function payload injection.en2026-10-20T06:21:57CandidateSource timeline
Discovered through CISA Known Exploited VulnerabilitiesView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Added to CISA Known Exploited Vulnerabilities catalogView source ↗
Record history
Record created from the first normalized source observation.
Metadata and source references refreshed.