https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 04:40:20 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-70374 <p>HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as &#39;thumbnail&#39; + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec (&#39;convert &#39; + tempFile + ...).</p> <p>HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as &#39;thumbnail&#39; + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec (&#39;convert &#39; + tempFile + ...).</p> https://db.gcve.eu/vuln/fkie_cve-2026-70374 https://db.gcve.eu/vuln/ghsa-f8rj-8x92-pfp5 <p>HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail() in src/Server/Entity/Resource/Media.js builds a temporary file path as &#39;thumbnail&#39; + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec() (&#39;convert &#39; + tempFile + ...). The MIME-type filter in getMIMEType() (src/Common/utilities.js) truncates the extracted extension at the first &#39;?&#39; character, while Path.extname() does not, allowing a filename such as &#39;x.jpg?$(command)&#39; to pass the image-type check while still injecting a shell command substitution into the exec() call. An authenticated user holding the media resource scope can achieve arbitrary OS command execution in the context of the Node.js process via POST /api/{project}/{environment}/media/new.</p> <p>HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail() in src/Server/Entity/Resource/Media.js builds a temporary file path as &#39;thumbnail&#39; + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec() (&#39;convert &#39; + tempFile + ...). The MIME-type filter in getMIMEType() (src/Common/utilities.js) truncates the extracted extension at the first &#39;?&#39; character, while Path.extname() does not, allowing a filename such as &#39;x.jpg?$(command)&#39; to pass the image-type check while still injecting a shell command substitution into the exec() call. An authenticated user holding the media resource scope can achieve arbitrary OS command execution in the context of the Node.js process via POST /api/{project}/{environment}/media/new.</p> https://db.gcve.eu/vuln/ghsa-f8rj-8x92-pfp5