Alijonov Alisher

**Name of the Vulnerable Software and Affected Versions** HashBrown CMS versions prior to 1.4.7 **Description** An OS Command Injection issue exists in the media upload thumbnail generation routine. The `Media.generateThumbnail()` function in `src/Server/Entity/Resource/Media.js` creates a temporary file path using `Path.extname(filename)` and passes it unescaped to a shell command executed via `AppService.exec()`. Because the MIME-type filter in `getMIMEType()` (located in `src/Common/utilities.js`) truncates extensions at the first '?' character while `Path.extname()` does not, an authenticated user with media resource scope can bypass image-type checks. By using a filename like `x.jpg?$(command)`, an attacker can execute arbitrary OS commands within the context of the Node.js process via the POST '/api/{project}/{environment}/media/new' endpoint. **Recommendations** Update HashBrown CMS to version 1.4.7 or later. As a temporary mitigation, restrict access to the POST '/api/{project}/{environment}/media/new' endpoint for users who do not strictly require media upload privileges.

**Name of the Vulnerable Software and Affected Versions** HashBrown CMS versions prior to 1.4.7 **Description** The Git deployer component contains an OS Command Injection flaw. The `pullRepo()` function in `src/Server/Entity/Deployer/GitDeployer.js` uses `AppService.exec()` to run a shell command that interpolates the configured branch value without proper escaping. While the `validate()` function rejects single quotes, it fails to filter other shell metacharacters such as `;`, `&&`, `|`, backticks, and `$()`. An attacker with permissions to configure Git deployer settings can specify a malicious branch value that executes arbitrary commands automatically during deployer operations, such as content saves or media uploads. **Recommendations** Update HashBrown CMS to a version newer than 1.4.6. Restrict access to the Git deployer configuration settings to trusted administrators only.

**Name of the Vulnerable Software and Affected Versions** Pluck CMS versions prior to 4.7.22 **Description** The admin file-management feature fails to properly restrict dangerous file uploads. The system uses a fixed blacklist in `data/inc/files.php` that checks the last 4-5 characters of a filename but omits the `.php8` extension. An authenticated administrator can upload a file with the `.php8` extension, which is stored unmodified. On servers running PHP 8.x, the web server executes this file as PHP, leading to remote code execution. **Recommendations** Update Pluck CMS to version 4.7.22 or later. As a temporary mitigation, restrict access to the admin file-management feature or ensure the server is not running PHP 8.x.

**Name of the Vulnerable Software and Affected Versions** Documize Community (affected versions not specified) **Description** An authorization bypass exists in the attachment download route. The `Download()` function, located in `domain/attachment/endpoint.go`, accepts a `secure` query parameter but only verifies that the parameter is not empty rather than validating it against a stored value. Consequently, providing any non-empty string in the `secure` parameter allows an attacker to bypass authentication and download attachments from any organization. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.