CVE-2024-39943

highpriority · attend · 59EPSS 0.395 · 99 %ileexploit · PoCEURUUS
grimoire priorityP1 · Urgent
Exploitable?
Public exploit
2 exploits · PoC
Likely / severe?
39.5% (99th) EPSS
CVSS 8.8 · high
Is it mine?
7 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · fstec_bdu · nvd

EPSS · scored 2026-10-27

rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).

01

cvss

Technical severity, 0–10. One row per scoring source.

9.9
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.8–9.9

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 5.9
v3.19.9criticalAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
v3.19.9criticalCVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:Nsecondary · ENISA EU
v3.19.9criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · cve@mitre.org USexploitability 3.1 · impact 6
v3.19.9criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · OSV
v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)
02

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-78USprimaryCWE-284USCWE-284USCWE-284USCWE-78USCWE-78US
04

exploits (2)

Public proof-of-concept and weaponised exploit code.

05

affected products (7)

Products and version ranges known to be affected.

06

advisories (1)

Vendor and ecosystem advisories describing this.

  • GHSA-5f4x-hwv2-w9w2rejetto HFS vulnerable to OS Command Execution by remote authenticated users2024-07-05ghsa · osvUS

    rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).

07

also known as (5)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bdunvdosvNVDCVE.orgMITRE
published 2024-07-04modified 2026-08-25
10

references (11)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan