A file-server tool just got a 'perfect 10' bug - but does anyone still use it?
HFS2's upload handler can reportedly be tricked into running commands with no login required, yet the advisories go quiet on the one question that matters: is anyone actually running this?
A newly disclosed flaw in HFS2, a lightweight tool used to serve files over HTTP, has been rated the maximum possible severity score of 10 out of 10. That sounds like the sort of thing that should have every IT department scrambling. Whether it actually should is a different question.
What the bug actually does
The vulnerability, tracked as CVE-2026-97359, sits in how HFS2 handles file uploads sent via multipart forms - the standard mechanism a browser uses when you pick a file and hit “upload”. According to VulnCheck’s advisory, the software runs filenames through a template engine without properly sanitising them first. Craft a filename containing the right closing sequence followed by an “exec” instruction, and the server will apparently try to run it as a command rather than just save it as a name.
Crucially, VulnCheck says this can be done without logging in at all. No password, no valid account - just a specially named file sent to an upload endpoint. That combination of no authentication required and full remote code execution is exactly why the flaw scores a perfect CVSS 10, the top of the scale reserved for bugs where an attacker gets total control with minimal effort. The issue affects HFS2 versions 2.0.0 through 2.4.0 and was credited to a researcher known as wgetnz.
So who is actually at risk
This is where the caution has to kick in. HFS2 is not Windows, Chrome or a piece of software with millions of active installs - it’s a niche, older-style file-sharing utility of the kind hobbyists, small studios or home labs sometimes spin up to shift files around a network. Before anyone panics, three things are conspicuously unconfirmed in the public advisories: whether a patched version exists, whether the bug is being exploited anywhere right now, and how many machines are even running HFS2 in the first place.
Neither NVD’s record nor VulnCheck’s write-up answers those questions. There’s no mention of a fixed release, no note of in-the-wild attacks, and no install-base figures - the exact checklist a sceptical reader should run through before treating any “critical” score as urgent. A CVSS 10 tells you how bad things could be if the software is exposed and unpatched; it says nothing about how likely you are to be running that software, or whether a fix is even available yet to apply.
If you don’t know what HFS2 is, you’re almost certainly not affected. If you do run it - perhaps to share files across a home network or a small office - the practical risk hinges entirely on whether it’s reachable from the open internet, since the flaw requires an attacker to reach the upload endpoint directly.
What to do about it
Anyone running HFS2 up to version 2.4.0 should check the project’s GitHub repository for an updated release and, in the meantime, make sure the server isn’t exposed to the wider internet - putting it behind a firewall or VPN removes the “unauthenticated” part of the equation that makes this bug so dangerous. If you’re not sure whether something on your network is running HFS2, a quick look at open ports and running services is worth ten minutes of anyone’s time.
The headline number here is genuinely eye-catching, but a CVSS 10 on a rarely-deployed file server is not the same story as a CVSS 10 in something like a browser or an operating system. Patch it if it’s yours, don’t lose sleep if it isn’t.