https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-39943.htmlhttps://patchthecve.com/cve/CVE-2024-39943.htmlWed, 17 Jun 2026 07:43:04 +0000CRITICAL 9.9: rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).https://patchthecve.com/cve/CVE-2024-23692.htmlhttps://patchthecve.com/cve/CVE-2024-23692.htmlTue, 11 Aug 2026 04:17:15 +0000CRITICAL 9.8: Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment dathttps://patchthecve.com/cve/CVE-2021-40668.htmlhttps://patchthecve.com/cve/CVE-2021-40668.htmlWed, 17 Jun 2026 04:07:14 +0000HIGH 8.1: The Android application HTTP File Server (Version 1.4.1) by 'slowscript' is affected by a path traversal vulnerability that permits arbitrary directory listing, file read, and file write.https://patchthecve.com/cve/CVE-2020-13432.htmlhttps://patchthecve.com/cve/CVE-2020-13432.htmlWed, 17 Jun 2026 02:53:08 +0000HIGH 7.5: rejetto HFS (aka HTTP File Server) v2.3m Build #300, when virtual files or folders are used, allows remote attackers to trigger an invalid-pointer write access violation via concurrent HTTP requests with a long URI or long HTTP headers.