Rejetto HFS versions 3.0.0 through 3.2.0 do not escape file names in the basic web listing, allowing a stored cross‑site scripting attack via malicious file names. An attacker with upload permission, or an anonymous user on servers with an open upload folder, can upload a file whose name contains script code; anyone viewing the listing with the ?get=basic parameter will have the code executed in their browser. This flaw represents a stored XSS vulnerability (CWE‑79) with a CVSS score of 5.1 indicating moderate severity.

The vulnerability affects all Rejetto HFS installations running versions 3.0.0 through 3.2.0, inclusive. Any instance that permits file uploads—either by authenticated users with upload rights or by anonymous clients where the upload directory is accessible—remains vulnerable because the basic listing can be invoked via the ?get=basic query string.

The CVSS score of 5.1 denotes moderate risk, while the EPSS score of less than 1% reflects a low but non‑zero likelihood of exploitation. The flaw is not listed in the CISA KEV catalog, indicating no known widespread attacks yet. Attackers can exploit the vulnerability from any web browser by uploading a maliciously named file and then forcing visitors to view the listing; the primary prerequisite is write access to the upload directory, a common setting in many deployments.