CVE-2026-70375: HashBrown CMS RCE Vulnerability

CVE-2026-70375 Overview

CVE-2026-70375 is an OS Command Injection vulnerability [CWE-78] in HashBrown CMS through version 1.4.6. The flaw resides in the Git deployer component, specifically the GitDeployer.pullRepo() function in src/Server/Entity/Deployer/GitDeployer.js. The function interpolates the configured branch value directly into a shell command without escaping, allowing an authenticated user with project deployer configuration access to inject arbitrary shell metacharacters. The injected commands execute automatically on every subsequent deployer operation, including media uploads and content saves.

Critical Impact
Authenticated attackers who can configure Git deployer settings gain arbitrary OS command execution on the HashBrown CMS server, leading to full host compromise.

Affected Products

HashBrown CMS versions through 1.4.6
src/Server/Entity/Deployer/GitDeployer.js component
Any HashBrown CMS deployment using the Git deployer feature

Discovery Timeline

2026-08-05 - CVE-2026-70375 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-70375

Vulnerability Analysis

The vulnerability lives in the GitDeployer.pullRepo() method, which invokes AppService.exec(\git checkout ${this.branch || 'master'}`). The branch value is interpolated directly into an unquoted shell command string. The GitDeployer.validate()routine only rejects the single-quote character across the repo, branch, username, and password fields. Shell metacharacters including;, &&, |, backticks, and $()` pass validation unchanged.

An attacker configures a project's Git deployer with a branch value such as master;<command>#. The injected command executes each time pullRepo() runs. HashBrown invokes pullRepo() unconditionally at the start of every deployer operation, so routine actions such as media uploads or content saves trigger execution. The injected payload inherits the privileges of the HashBrown CMS server process.

Root Cause

The root cause is unsafe string interpolation of user-controlled input into a shell command combined with an incomplete validation deny list. The prior fix for CVE-2020-6948 escaped single quotes in git clone arguments for the repo, username, and password fields. That patch did not cover the branch field or the unquoted git checkout invocation, leaving the injection primitive intact.

Attack Vector

Exploitation requires an authenticated account with permission to modify a project's Git deployer configuration. The attacker sets a malicious branch string containing shell metacharacters. No further interaction is required beyond triggering any deployer-invoking action, which is a normal CMS workflow. Successful exploitation yields command execution in the context of the Node.js server process.

See the TuranSec Security Advisory TRN-B571F773 for full technical detail and the HashBrown CMS repository for source context.

Detection Methods for CVE-2026-70375

Indicators of Compromise

Unexpected child processes spawned by the Node.js process hosting HashBrown CMS, particularly shells (/bin/sh, bash) invoked outside normal git operations.
Git deployer configuration entries where the branch field contains ;, &&, |, backticks, or $() sequences.
Outbound network connections from the CMS host to unfamiliar destinations following deployer activity.
New files, cron entries, or SSH keys created under the CMS service account after a deployer operation.

Detection Strategies

Audit HashBrown CMS project settings for branch values that fail a strict allowlist of [A-Za-z0-9._/-].
Monitor process ancestry: alert when git checkout is followed by execution of interpreters or system utilities in the same session.
Review web server access logs for POST requests to deployer configuration endpoints from non-administrative accounts.

Monitoring Recommendations

Enable command-line auditing on the CMS host and forward events to a centralized log platform for correlation.
Track file integrity on src/Server/Entity/Deployer/GitDeployer.js and adjacent deployer modules to detect tampering.
Alert on any modification to project configuration files that store deployer credentials or branch values.

How to Mitigate CVE-2026-70375

Immediate Actions Required

Restrict access to project deployer configuration to fully trusted administrators until a fix is applied.
Audit all existing Git deployer configurations and remove or sanitize any branch values containing shell metacharacters.
Rotate any credentials, SSH keys, or tokens accessible to the CMS service account if suspicious deployer activity is found.
Run the HashBrown CMS process under a least-privilege account without shell access or sudo rights.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry. Track the HashBrown CMS repository and the TuranSec advisory for fix releases. Apply any update that replaces string interpolation in GitDeployer.pullRepo() with argument-array execution or that enforces a strict branch-name allowlist.

Workarounds

Disable the Git deployer feature entirely if it is not required for the deployment workflow.
Apply a local source patch that validates branch, repo, username, and password fields against ^[A-Za-z0-9._/-]+$ before use.
Replace AppService.exec calls in GitDeployer.js with child_process.execFile using an argument array so shell interpretation is bypassed.
Place the CMS behind a reverse proxy that restricts access to deployer configuration routes by source IP.

bash

# Example allowlist validation applied before deployer save
BRANCH="$1"
if ! [[ "$BRANCH" =~ ^[A-Za-z0-9._/-]+$ ]]; then
  echo "Rejected: branch contains disallowed characters" >&2
  exit 1
fi