CyberRota Analysis
AI-GeneratedHashBrown CMS versions up to 1.4.6 are vulnerable to an OS Command Injection in the media upload thumbnail generation process, allowing authenticated users with media resource permissions to execute arbitrary commands on the server. This vulnerability arises from improper handling of file paths, where user-controlled input can bypass MIME-type checks and lead to command execution within the Node.js environment. Organizations using this CMS should prioritize remediation to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec ('convert ' + tempFile + ...).