Rejetto HFS versions 3.0.0 through 3.2.0 contain a path traversal flaw in the lang query parameter that allows an unauthenticated attacker to read certain JSON files outside the designated shared folders. This is a CWE-22 vulnerability. The flaw is limited to files that match a specific naming and format pattern, which reduces the breadth of the potential data exposure.

The affected product is Rejetto HFS. Users running version 3.0.0 up to and including 3.2.0 are vulnerable. Vendor references include the Rejetto HFS releases list and advisory links.

With a CVSS score of 6.9, the flaw presents a moderate severity. The EPSS score is < 1%, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via an HTTP request containing a crafted 'lang' parameter. When exploited, an attacker can read constrained JSON files located outside the shared directories, but the limited file selection reduces the overall impact risk.