CVE-2008-0405: Multiple directory traversal vulnerabilities in HTTP File Server (HFS) before 2.2c, when account names are...

Security readout for executives and security teams

This CVE affects old HTTP File Server installations before 2.2c. A remote attacker could abuse account-name handling in log filenames to create files or directories, or append data to files. For a business, the main concern is unauthorized filesystem changes on a file-sharing server, especially if the server is internet-facing. Exposure is most likely in legacy Rejetto HFS deployments before 2.2c, particularly public file-sharing servers or systems where remote users can influence account names. The bundle’s affected CPE data is incomplete, so inventory should be based on product/version evidence, not CPE matching alone. Prioritize remediation for any internet-facing HFS instance. The vulnerability is old, public, and affects server-side filesystem integrity. If HFS is internal-only and already upgraded or retired, urgency is lower but still warrants inventory confirmation. Mitigation focus: Upgrade HFS to version 2.2c or later where applicable.; Check current Rejetto guidance for supported versions and migration recommendations.; Restrict public access to legacy HFS instances until remediated..

Prepared

Jun 28, 2026, 19:27 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.