The vulnerability stems from a missing authorization check in HFS2's macro dispatcher combined with a path resolver that does not confine absolute paths. This flaw permits an attacker to request the execution of arbitrary template files and thereby read, write, append, or delete any file within the filesystem that the HFS service account can access, including locations outside the configured shared folder. The resulting compromise threatens confidentiality, integrity, and availability of the host system.

Affected systems include the Rejetto HFS2 web file server, specifically version 2.4.0 and all earlier releases. Attackers do not need any prior authentication and can target the template engine through the exposed HTTP interface.

The CVSS score of 10 reflects a critical weakness with high exploitation potential. While EPSS data is not available, the lack of a KEV listing does not reduce the urgency of remediation. The attack vector is unauthenticated remote, leveraging the public template engine endpoint. Given that any host with network reachability to the HFS2 instance can trigger the flaw, the likelihood of exploitation is substantial for exposed deployments.