Most recent entries from all https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 17:15:22 +0000 CVE-2026-70374 — HashBrown CMS - OS Command Injection in Media Upload Thumbnail Generation https://db.gcve.eu/vuln/cve-2026-70374 <p><strong>Affected:</strong> HashBrownCMS hashbrown-cms</p> <p>HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as &#39;thumbnail&#39; + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec (&#39;convert &#39; + tempFile + ...).</p> <p><strong>Affected:</strong> HashBrownCMS hashbrown-cms</p> <p>HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as &#39;thumbnail&#39; + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec (&#39;convert &#39; + tempFile + ...).</p> https://db.gcve.eu/vuln/cve-2026-70374