CVE-2026-97359
CRITICAL
NVD
CVSS Score
10
Severity
CRITICAL
Published
Sep 24, 2026
Vendor
unknown
Description
HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template quoting sequence followed by an exec macro, which bypasses the authorization check in the dispatcher to execute arbitrary commands on the underlying host system.