ACTIVELY EXPLOITED

CVE-2014-6287: Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability

Facts
Vendor	Rejetto
Product	HTTP File Server (HFS)
Actively exploited	Yes
Added to CISA KEV	25 Mar 2022
CISA federal deadline	15 Apr 2022
Weakness (CWE)	CWE-94

Required action (CISA's text)

Apply updates per vendor instructions.

Description (NVD)

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (HFS or HttpFileServer) allows remote attackers to execute arbitrary programs.

SOURCES

CISA KEVCISA Known Exploited Vulnerabilities catalog

Other Rejetto flaws

CVE-2024-23692: Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.