CVE-2024-39943: exploitation status and patch state

CVE-2024-39943 · CVSS 9.9 CRITICAL · EPSS 39%

rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).

Is CVE-2024-39943 exploited?

• Not in the CISA KEV catalog.
• EPSS puts exploitation in the next 30 days at 39%.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

• rejetto · http_file_server · >= 0, < 0.52.10

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2024-39943

• Hunt.io Finds Dahua Cameras Kept Reconnecting (2026-08-19)

Primary sources

• NVD record

What this record does not say

• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-08-19.