CVE-2026-44666: HRConvert2: OS Command Injection via Incomplete Filename Sanitization
HRConvert2 versions before 3.3.8 fail to remove backtick and tab characters in the sanitizeString() function, so user-supplied filenames can reach shell_exec() and trigger command execution. The GitHub CNA scores the issue 9.3 under CVSS 4.0 and the record shows no CISA KEV listing. Upgrading to 3.3.8 is the fix referenced by the sources.
Overview
HRConvert2 is a self-hosted file conversion and sharing server. According to the CVE record, versions before 3.3.8 do not strip backtick and tab characters in the sanitizeString() function in convertCore.php. User input from filenames can then reach shell_exec(), where the shell interprets these characters and can run embedded commands.
Impact
The record assigns a CVSS 4.0 base score of 9.3 from GitHub as CNA. The vector indicates network attack vector, low attack complexity, no attack requirements, no privileges required and no user interaction, with high impact on confidentiality, integrity and availability of the vulnerable component. The weakness is classified as CWE-78, OS Command Injection. The record title describes the flaw as unauthenticated remote command execution.
Affected products and versions
- Product: Zelon88 HRConvert2
- Affected range in the record: versions before 3.3.8
- Fixed version: 3.3.8, as stated in the record description and in the linked release reference. The structured fixes field in the record is empty.
Exploitation status
The record lists this CVE as not present in the CISA KEV catalog. Its SSVC data indicates exploitation status poc and automatable yes, which points to published proof-of-concept activity without confirmed exploitation. No confirmed exploitation in the wild appears in the sources consulted.
Remediation and mitigation
- Upgrade HRConvert2 to version 3.3.8 or later, the version referenced by the advisory and release.
- Until the upgrade is complete, limit network access to the service to trusted users and networks.
- Review whether the service is exposed to the internet and restrict it where business needs allow.
- Prefer server-side validation that rejects unexpected characters in filenames over reliance on partial character stripping.
Detection guidance
- Review application and web server logs for uploads or requests with filenames containing backticks, tabs or other shell metacharacters.
- Monitor for unexpected child processes started by the web server or PHP runtime.
- Check application directories for unexpected files or modifications created after suspicious activity.
Limitations of the available information
The record does not describe the exact exploitation conditions, the default configuration, or which deployments are most exposed. The structured fixes field is empty, so the fixed version is taken from the description and release reference. The EPSS data in the record carries a date that should be verified against the current feed. No CVSS 3.x score is provided.
Frequently asked questions
Which versions of HRConvert2 are affected?
The record lists Zelon88 HRConvert2 versions before 3.3.8 as affected.
Is there a fix for CVE-2026-44666?
The description and the linked release reference state that the issue is fixed in version 3.3.8. The structured fixes field in the record is empty.
Is this vulnerability listed in CISA KEV?
No. The record shows the CVE is not listed in the KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.