Rejetto HFS versions 3.0.0 through 3.2.0 permit Cross‑Site Request Forgery because they allow state‑changing API requests to be processed via the GET method and omit the anti‑CSRF header check for such requests. Exploiting this flaw lets an attacker construct a URL that, when visited, performs administrative actions such as creating accounts, modifying configuration, or executing server‑side code. This vulnerability is classified as CWE‑352 and can ultimately lead to remote code execution on the server.

The vulnerability affects installations of the Rejetto HFS web framework that are running any release older than 3.2.1, specifically versions 3.0.0, 3.0.1, 3.0.2, 3.1.0, 3.1.1, 3.1.2, 3.1.3, and 3.2.0. Earlier builds not listed may also be vulnerable, but the CVE does not enumerate them explicitly. Systems that host the default administrative endpoints are included.

The CVSS score of 5.1 places this issue in the moderate severity class. The EPSS score below 1% indicates a low exploitation probability based on current data, but the risk remains significant for unpatched installations that expose administrative endpoints to the Internet or rely on default accounts. Based on the description, it is inferred that an attacker does not need any special setup beyond provoking the victim’s browser to fetch the crafted GET request, or can execute the flaw locally if the application is configured with default settings. While the vulnerability is not listed in the CISA KEV catalog, the potential for remote code execution is a critical consideration for administrators of affected installations.