8.8
CVE-2026-70374
- EPSS 0.97%
- Veröffentlicht 05.08.2026 05:46:19
- Zuletzt bearbeitet 10.08.2026 12:17:23
- CVE-Watchlists
- Unerledigt
HashBrown CMS - OS Command Injection in Media Upload Thumbnail Generation
HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec ('convert ' + tempFile + ...).Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerHashBrownCMS
≫
Produkt
hashbrown-cms
Default Statusunknown
Version <=
1.4.6
Version
0
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.97% | 0.587 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
https://github.com/HashBrownCMS/hashbrown-cms
https://cve.turansec.uz/advisories/TRN-11FC0D88