CVE-2024-23692: Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

Q: How do I fix CVE-2024-23692?

http file server: upgrade to newer than 2.4. Exact commands for each OS are on this page.

Q: Is CVE-2024-23692 being exploited?

Yes. CVE-2024-23692 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

Q: What does CVE-2024-23692 affect?

CVE-2024-23692 affects http file server. Severity is critical (CVSS 9.8). Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a

Q: How urgent is CVE-2024-23692?

Priority 100/100. Critical severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Used in ransomware campaigns; Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

100

Patch now

CRITICAL 9.8EXPLOITEDREMOTEUPGRADE

CVE-2024-23692 is a critical-severity flaw (CVSS 9.8) affecting http file server, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.

Why this priority

Critical severity
EPSS top 1%: very likely to be exploited
Exploited in the wild (CISA KEV)
Used in ransomware campaigns
Public exploit reference
CISA SSVC: automatable with total technical impact
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	99.5% (top 1%)
CISA exploited list	Yes, fix due 2024-07-30, used in ransomware
Weakness	CWE-1336, CWE-94
Published	2024-05-31
Last modified	2026-08-11

Publisher (CNA): VulnCheck · Vendor: rejetto

Last updated 2026-08-11 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2024-05-31 10:15 UTCPublished CVE record published
2024-07-09Exploited Added to the CISA Known Exploited Vulnerabilities list
2024-07-30Deadline CISA due date for US federal agencies to patch
2026-08-11 04:17 UTCUpdated Record last modified

rejetto http file server UPGRADE

Affected: <= 2.4

Fixed in: newer than 2.4

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy http-file-server || rpm -q http-file-server || http-file-server --version

2. UPGRADE to newer than 2.4 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade http-file-server

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade http-file-server

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Exact fixes by distribution

Fedora ELN · efifs · FIXED · 1.13-1.eln159 · FEDORA-2026-3fd0bb7307 · source

sudo dnf upgrade --advisory=FEDORA-2026-3fd0bb7307

Fedora 46 · efifs · FIXED · 1.13-1.fc46 · FEDORA-2026-27ec2fc8fc · source

sudo dnf upgrade --advisory=FEDORA-2026-27ec2fc8fc

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: verylazytech/CVE-2024-23692 (51 stars)
GitHub PoC: jakabakos/CVE-2024-23692-RCE-in-Rejetto-HFS (17 stars)
GitHub PoC: 0x20c/CVE-2024-23692-EXP (15 stars)
Write-up: github.com/rapid7/metasploit-framework/pull/19240
Write-up: mohemiv.com/all/rejetto-http-file-server-2-3m-unauthenticated-rce/
Exploit-DB: Rejetto HTTP File Server 2.3m - Remote Code Execution (RCE)
Metasploit: Rejetto HTTP File Server (HFS) Unauthenticated Remote Code Execution
Nuclei scan template: Rejetto HTTP File Server - Template injection

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2024-23692?

http file server: upgrade to newer than 2.4. Exact commands for each OS are on this page.

Is CVE-2024-23692 being exploited?

Yes. CVE-2024-23692 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2024-23692 affect?

CVE-2024-23692 affects http file server. Severity is critical (CVSS 9.8). Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a

How urgent is CVE-2024-23692?

Priority 100/100. Critical severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Used in ransomware campaigns; Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

Related CVEs

CVE-2024-39943 CRITICAL 9.9 UPGRADE rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by r
CVE-2021-40668 HIGH 8.1 DOWNGRADE The Android application HTTP File Server (Version 1.4.1) by 'slowscript' is affected by a path traversal vulne
CVE-2020-13432 HIGH 7.5 DOWNGRADE rejetto HFS (aka HTTP File Server) v2.3m Build #300, when virtual files or folders are used, allows remote att

References

← Back to latest CVEs