CVE-2026-70375

HighCVSS 8.8

Published: 05/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.98%

59th percentile - higher than 59% of all known CVEs

Summary

Vulnerability in HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping.

Risk Assessment

Risk of remote execution of arbitrary system commands on the server, potentially leading to full system and data compromise.

Recommendation

Upgrade HashBrown CMS to a version newer than 1.4.6 or apply appropriate mitigations such as input validation and escaping.

Other vulnerabilities in HashBrown CMS

CVE-2026-70374High
A vulnerability in HashBrown CMS (up to version 1.4.6) allows OS command injection (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec ('convert ' + tempFile + ...).

Original NVD description (English source)

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping.