CVE-2014-6287

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or...

9.8 CriticalIn KEVPublic exploit

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

99.3%Up 6.2 points since Feb 4, 2022

What each source reports

NVD Score used 9.8

Record: CVE-2014-6287
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-94
Updated: 2026-11-02

CVE List 9.8

Record: CVE-2014-6287
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

EUVDEUVD-2014-6172 9.8

Record: EUVD-2014-6172
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-2hx5-63mq-crfj 9.8

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or...

Record: GHSA-2hx5-63mq-crfj
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

CISA KEV No score

Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (HFS or HttpFileServer) allows remote attackers to execute arbitrary programs.

Record: CVE-2014-6287
Weakness: CWE-94
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	Rejetto HttpFileServer Remote Command Execution	2014-09-11
Exploit-DB	Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution (1)	2014-09-15
Exploit-DB	Rejetto HTTP File Server (HFS) - Remote Command Execution (Metasploit)	2014-10-09
Exploit-DB	Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution (2)	2016-01-04
PoC in GitHub	roughiz/cve-2014-6287.py	2019-12-27
Exploit-DB	Rejetto HttpFileServer 2.3.x - Remote Command Execution (3)	2020-11-30
PoC in GitHub	Nicoslo/Windows-exploitation-Rejetto-HTTP-File-Server-HFS-2.3.x-CVE-2014-6287	2021-02-20
PoC in GitHub	mrintern/thm_steelmountain_CVE-2014-6287	2021-12-03
PoC in GitHub	randallbanner/Rejetto-HTTP-File-Server-HFS-2.3.x---Remote-Command-Execution	2023-04-04
PoC in GitHub	zhsh9/CVE-2014-6287	2024-03-06

Show 9 moreShow less

Public exploits
Source	Link	Date
PoC in GitHub	10cks/CVE-2014-6287	2024-06-12
PoC in GitHub	francescobrina/hfs-cve-2014-6287-exploit	2024-11-24
PoC in GitHub	Z3R0space/CVE-2014-6287	2025-06-20
PoC in GitHub	rahisec/rejetto-http-file-server-2.3.x-RCE-exploit-CVE-2014-6287	2025-07-11
PoC in GitHub	nika0x38/CVE-2014-6287	2025-09-16
PoC in GitHub	JoaZ94/rejjeto_hfs-rce-exploit-cve-2014-6287	2025-12-07
PoC in GitHub	jagg3rsec/CVE-2014-6287	2026-01-25
PoC in GitHub	R3fr4kt/Optimum	2026-03-10
Nuclei	HTTP File Server <2.3c - Remote Command Execution

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation, exploits
Nov 2, 2026	first indexed	CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-6287 is a critical vulnerability (CVSS 9.8) in Rejetto Http File Server, published October 7, 2014. CISA lists it as known to be exploited, since March 25, 2022. EUVD reports exploitation since March 25, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.3%, the 99th percentile. No source names a fixed version.

References

Show 4 moreShow less