CVE-2026-70374: HashBrown CMS RCE Vulnerability

CVE-2026-70374 Overview

CVE-2026-70374 is an OS Command Injection vulnerability [CWE-78] in HashBrown CMS through version 1.4.6. The flaw resides in the media upload thumbnail generation routine, where a filename is passed unescaped into a shell command executed by AppService.exec(). An inconsistency between the MIME-type filter in getMIMEType() and Node.js Path.extname() allows a crafted filename to bypass the image-type check while injecting shell command substitution. An authenticated user holding the media resource scope can achieve arbitrary OS command execution in the context of the Node.js process through POST /api/{project}/{environment}/media/new.

Critical Impact
Authenticated attackers with media resource scope can execute arbitrary operating system commands as the Node.js process user, resulting in full application compromise.

Affected Products

HashBrown CMS versions through 1.4.6
Deployments exposing /api/{project}/{environment}/media/new to authenticated users
Node.js-based HashBrown CMS installations using the default media upload workflow

Discovery Timeline

2026-08-05 - CVE-2026-70374 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70374

Vulnerability Analysis

The vulnerability exists in Media.generateThumbnail() located in src/Server/Entity/Resource/Media.js. The function constructs a temporary file path by concatenating the string thumbnail with the return value of Path.extname(filename). This temporary path is then passed unescaped into a shell command string of the form convert + tempFile + additional arguments, which is executed through AppService.exec().

Because the shell command is built with string concatenation and executed via a shell interpreter, any metacharacters preserved in the filename extension propagate directly to the shell. The convert invocation acts as the injection sink, but the attacker-controlled substring can carry command substitution syntax such as $(...) or backticks.

Root Cause

The root cause is inconsistent extension parsing between two functions. The MIME-type filter in getMIMEType() (in src/Common/utilities.js) truncates the extracted extension at the first ? character before checking whether the file is a permitted image type. In contrast, Path.extname() does not truncate at ? and returns the entire trailing segment after the last dot.

A filename such as x.jpg?$(command) therefore passes the image-type check as .jpg, while Path.extname() returns .jpg?$(command). The unsanitized extension is concatenated into the shell command and evaluated by the shell.

Attack Vector

An authenticated user with the media resource scope submits a crafted upload to POST /api/{project}/{environment}/media/new. The filename embeds a shell command substitution sequence after a ? separator following a valid image extension. When the thumbnail routine calls AppService.exec(), the shell parses and executes the injected commands in the context of the Node.js process. See the TuranSec Security Advisory for technical details.

Detection Methods for CVE-2026-70374

Indicators of Compromise

Media upload requests to /api/{project}/{environment}/media/new containing ? characters or shell metacharacters ($, `, ;, |) within the filename field
Unexpected child processes spawned by the HashBrown CMS Node.js process, particularly shells such as sh, bash, or cmd
convert process invocations with malformed temporary file path arguments containing command substitution syntax

Detection Strategies

Inspect web server and application logs for POST requests to the media upload endpoint containing suspicious filename patterns matching .*\.(jpg|png|gif|jpeg)\?.*
Monitor process ancestry on the HashBrown CMS host for shell processes descending from the Node.js runtime
Alert on file writes or outbound network connections originating from the HashBrown CMS process shortly after media upload activity

Monitoring Recommendations

Enable verbose HTTP request logging for the media API endpoints and retain filenames as submitted by clients
Forward Node.js process telemetry and child-process creation events to a centralized analytics platform for correlation
Baseline normal convert invocations produced by the CMS and alert on argument strings that deviate from expected image-thumbnail patterns

How to Mitigate CVE-2026-70374

Immediate Actions Required

Restrict the media resource scope to trusted administrative accounts until a fixed release is deployed
Place the HashBrown CMS application behind a web application firewall rule that blocks ? and shell metacharacters in uploaded filenames
Audit existing media directories and server logs for prior exploitation attempts against /api/{project}/{environment}/media/new

Patch Information

No vendor patch is referenced in the enriched CVE data at the time of publication. Track the HashBrown CMS GitHub repository for updated releases beyond version 1.4.6 and apply them once available.

Workarounds

Disable the media upload feature or remove the media resource scope from non-administrative roles until an official patch is applied
Deploy a reverse proxy rule that rejects requests where the name field of the upload payload contains characters outside [A-Za-z0-9._-]
Run the HashBrown CMS Node.js process under a dedicated low-privilege user with no shell access to limit the impact of successful injection

bash

# Configuration example: nginx rule to reject suspicious media upload filenames
location ~ ^/api/[^/]+/[^/]+/media/new$ {
    if ($request_body ~* "\"name\"\s*:\s*\"[^\"]*[\?\$\`\;\|][^\"]*\"") {
        return 400;
    }
    proxy_pass http://hashbrown_backend;
}