The vulnerability is a template injection flaw in the multipart upload handler of HFS2, allowing an unauthenticated attacker to execute arbitrary commands on the host by embedding malicious template syntax within the filename. This flaw bypasses the intended authorization checks in the dispatcher, effectively enabling remote code execution on the underlying system.

Rejetto HFS2 versions 2.4.0 and earlier are vulnerable. The issue is specific to the proprietary HFS2 web server product

The CVSS score of 10.0 indicates critical severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but the attack vector is unauthenticated remote exploitation via an HTTP multipart request. An attacker can construct a filename containing template syntax that closes the current context and injects an exec macro, thereby executing arbitrary commands without any authentication. Given the critical CVSS score, the risk to exposed instances is high, and deployment of the vulnerable version poses a significant threat to confidentiality, integrity, and availability of affected hosts.