HIGH

CVE-2026-70375

2026-08-05 CVSS v3.1

CVSS

8.8

Description

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping.

Weakness (CWE)

CWE-78 OS Command Injection

EPSS Score

0.98%

Probability of exploitation in next 30 days

60.7th percentile

References

https://cve.turansec.uz/advisories/TRN-B571F773 https://github.com/HashBrownCMS/hashbrown-cms

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE