HIGH

CVE-2026-70374

2026-08-05 CVSS v3.1

CVSS

8.8

Description

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec ('convert ' + tempFile + ...).

Weakness (CWE)

CWE-78 OS Command Injection

EPSS Score

0.97%

Probability of exploitation in next 30 days

60.4th percentile

References

https://cve.turansec.uz/advisories/TRN-11FC0D88 https://github.com/HashBrownCMS/hashbrown-cms

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE