CVE-2026-70374
HashBrown CMS: OS Command Injection in Media Upload Thumbnail Generation
HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail() in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec() ('convert ' + tempFile + ...). The MIME-type filter in getMIMEType() (src/Common/utilities.js) truncates the extracted extension at the first '?' character, while Path.extname() does not, allowing a filename such as 'x.jpg?$(command)' to pass the image-type check while still injecting a shell command substitution into the exec() call. An authenticated user holding the media resource scope can achieve arbitrary OS command execution in the context of the Node.js process via POST /api/{project}/{environment}/media/new.
| CWE | CWE-78 |
| Vendor | hashbrowncms |
| Product | hashbrown-cms |
| Published | Aug 5, 2026 |
Get instant alerts for hashbrowncms hashbrown-cms
Be the first to know when new unknown vulnerabilities affecting hashbrowncms hashbrown-cms are published — delivered to Slack, Telegram or Discord.