CVE-2014-6287
Critical 9.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.
Metrics
- CVSS 3.1
-
9.8 (CRITICAL)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 99% (percentile: 100) as of 1 November 2026
- CWE
- CWE-94
Affected products
rejetto: http file server
References
- http://packetstormsecurity.com/files/128243/HttpFileServer-2.3.x-Remote-Command… ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/135122/Rejetto-HTTP-File-Server-2.3.x-Remo… ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/160264/Rejetto-HttpFileServer-2.3.x-Remote… ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/161503/HFS-HTTP-File-Server-2.3.x-Remote-C… ExploitThird Party AdvisoryVDB Entry
- https://github.com/rapid7/metasploit-framework/pull/3793 Exploit
- https://www.exploit-db.com/exploits/39161/ ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/128243/HttpFileServer-2.3.x-Remote-Command… ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/135122/Rejetto-HTTP-File-Server-2.3.x-Remo… ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/160264/Rejetto-HttpFileServer-2.3.x-Remote… ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/161503/HFS-HTTP-File-Server-2.3.x-Remote-C… ExploitThird Party AdvisoryVDB Entry