CVE-2026-70374

Name of the Vulnerable Software and Affected Versions HashBrown CMS versions prior to 1.4.7

Description An OS Command Injection issue exists in the media upload thumbnail generation routine. The Media.generateThumbnail() function in src/Server/Entity/Resource/Media.js creates a temporary file path using Path.extname(filename) and passes it unescaped to a shell command executed via AppService.exec(). Because the MIME-type filter in getMIMEType() (located in src/Common/utilities.js) truncates extensions at the first '?' character while Path.extname() does not, an authenticated user with media resource scope can bypass image-type checks. By using a filename like x.jpg?$(command), an attacker can execute arbitrary OS commands within the context of the Node.js process via the POST '/api/{project}/{environment}/media/new' endpoint.

Recommendations Update HashBrown CMS to version 1.4.7 or later. As a temporary mitigation, restrict access to the POST '/api/{project}/{environment}/media/new' endpoint for users who do not strictly require media upload privileges.