Description
When adding a “web link” to the HFS virtual filesystem, the frontend opens it with target="_blank" but without the rel="noopener noreferrer" attribute. This allows the opened page to use the window.opener property to change the location of the original HFS tab.
Recommendation
Update the hfs package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.57.9
- Patched version(s): 0.57.10
References
Could your website be exposed too?
SmartScanner can check your website for HFS user adding a "web link" in HFS is vulnerable to "target=_blank" exploit and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Twitter-Post-Fetcher vulnerable to Use of Web Link to Untrusted Target with window.opener Access - CVE-2018-25058
- Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters - Vulnerability
- @saltcorn/data: Tenant user role is used for tenant creation role check - Vulnerability
- Fiora chat user avatar is vulnerable to XSS via SVG files - CVE-2025-56514
You might also like:
See something that needs correcting? Let us knowUpdated August 12, 2025