HashBrownCMS Hashbrown-cms vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting HashBrownCMS Hashbrown-cms: 2 record(s), with affected versions and fixes.
CVE-2026-70375
High · 8.8
CWE-78 Aug 5, 2026
HashBrown CMS - OS Command Injection via Git Deployer Branch Field
HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping.
CVE-2026-70374
High · 8.8
CWE-78 Aug 5, 2026
HashBrown CMS - OS Command Injection in Media Upload Thumbnail Generation
HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec ('convert ' + tempFile + ...).