CVE-2026-97359

Name of the Vulnerable Software and Affected Versions HFS2 versions prior to 2.4.1

Description A template injection issue exists in the multipart upload handler. Unauthenticated attackers can achieve remote code execution by embedding malicious template syntax within a filename. By crafting a filename that includes a closing template quoting sequence followed by an exec macro, the authorization check in the dispatcher is bypassed, allowing the execution of arbitrary commands on the host system.

Recommendations Update HFS2 to a version newer than 2.4.0.