CVE-2026-70374 (GCVE-0-2026-70374)

Vulnerability from cvelistv5 – Published: 2026-08-05 05:46 – Updated: 2026-08-05 05:46
VLAI
Title
HashBrown CMS: OS Command Injection in Media Upload Thumbnail Generation
Summary
HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail() in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec() ('convert ' + tempFile + ...). The MIME-type filter in getMIMEType() (src/Common/utilities.js) truncates the extracted extension at the first '?' character, while Path.extname() does not, allowing a filename such as 'x.jpg?$(command)' to pass the image-type check while still injecting a shell command substitution into the exec() call. An authenticated user holding the media resource scope can achieve arbitrary OS command execution in the context of the Node.js process via POST /api/{project}/{environment}/media/new.
Severity
No CVSS data available.
CWE
  • CWE-78 - OS Command Injection
Assigner
References
Impacted products
Vendor Product Version
HashBrownCMS hashbrown-cms Affected: 0 , ≤ 1.4.6 (semver)
Create a notification for this product.
Credits
Alijonov Alisher
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "hashbrown-cms",
          "programFiles": [
            "src/Server/Entity/Resource/Media.js",
            "src/Common/utilities.js"
          ],
          "repo": "https://github.com/HashBrownCMS/hashbrown-cms",
          "vendor": "HashBrownCMS",
          "versions": [
            {
              "lessThanOrEqual": "1.4.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alijonov Alisher"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail() in src/Server/Entity/Resource/Media.js builds a temporary file path as \u0027thumbnail\u0027 + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec() (\u0027convert \u0027 + tempFile + ...). The MIME-type filter in getMIMEType() (src/Common/utilities.js) truncates the extracted extension at the first \u0027?\u0027 character, while Path.extname() does not, allowing a filename such as \u0027x.jpg?$(command)\u0027 to pass the image-type check while still injecting a shell command substitution into the exec() call. An authenticated user holding the media resource scope can achieve arbitrary OS command execution in the context of the Node.js process via POST /api/{project}/{environment}/media/new."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 OS Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T05:46:19.284Z",
        "orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "shortName": "TuranSec"
      },
      "references": [
        {
          "url": "https://github.com/HashBrownCMS/hashbrown-cms"
        },
        {
          "url": "https://cve.turansec.uz/advisories/TRN-11FC0D88"
        }
      ],
      "title": "HashBrown CMS: OS Command Injection in Media Upload Thumbnail Generation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
    "assignerShortName": "TuranSec",
    "cveId": "CVE-2026-70374",
    "datePublished": "2026-08-05T05:46:19.284Z",
    "dateReserved": "2026-08-04T07:13:07.993Z",
    "dateUpdated": "2026-08-05T05:46:19.284Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.