CVE-2026-70374

HighCVSS 8.8

Published: 05/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.97%

59th percentile - higher than 59% of all known CVEs

Summary

A vulnerability in HashBrown CMS (up to version 1.4.6) allows OS command injection (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec ('convert ' + tempFile + ...).

Risk Assessment

An attacker can execute arbitrary system commands on the server, potentially leading to full system and data compromise.

Recommendation

Update HashBrown CMS to a version newer than 1.4.6 or apply appropriate security patches.

Other vulnerabilities in HashBrown CMS

CVE-2026-70375High
Vulnerability in HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping.

Original NVD description (English source)

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec ('convert ' + tempFile + ...).