Charmindoge

**Name of the Vulnerable Software and Affected Versions** rejetto HFS (aka HTTP File Server) 3 versions prior to 0.52.10 **Description** Remote authenticated users with upload permissions can execute operating system commands on Linux, UNIX, and macOS. This issue occurs because the software uses a shell to execute the `df` command via the `execSync` function instead of `spawnSync` within the Node.js `child process` module. **Recommendations** Update rejetto HFS (aka HTTP File Server) 3 to version 0.52.10 or later.