CVE-2026-70375

Name of the Vulnerable Software and Affected Versions HashBrown CMS versions prior to 1.4.7

Description The Git deployer component contains an OS Command Injection flaw. The pullRepo() function in src/Server/Entity/Deployer/GitDeployer.js uses AppService.exec() to run a shell command that interpolates the configured branch value without proper escaping. While the validate() function rejects single quotes, it fails to filter other shell metacharacters such as ;, &&, |, backticks, and $(). An attacker with permissions to configure Git deployer settings can specify a malicious branch value that executes arbitrary commands automatically during deployer operations, such as content saves or media uploads.

Recommendations Update HashBrown CMS to a version newer than 1.4.6. Restrict access to the Git deployer configuration settings to trusted administrators only.