https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-29T17:15:26.856392+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-70374 CVE-2026-70374 — HashBrown CMS - OS Command Injection in Media Upload Thumbnail Generation 2026-09-29T17:15:26.858086+00:00

Affected: HashBrownCMS hashbrown-cms

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec ('convert ' + tempFile + ...).