OS Command Injection in HashBrown CMS Media Thumbnail Generation

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail() in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec() ('convert ' + tempFile + ...). The MIME-type filter in getMIMEType() (src/Common/utilities.js) truncates the extracted extension at the first '?' character, while Path.extname() does not, allowing a filename such as 'x.jpg?$(command)' to pass the image-type check while still injecting a shell command substitution into the exec() call. An authenticated user holding the media resource scope can achieve arbitrary OS command execution in the context of the Node.js process via POST /api/{project}/{environment}/media/new.

Casky was already ahead

This CVE exploits attack patterns that Casky's 446matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

HashBrown CMS versions through 1.4.6 contain a critical OS command injection vulnerability in the media upload thumbnail generation routine. The vulnerability exists in Media.generateThumbnail() where user-supplied filenames are passed unsanitized into shell commands executed via ImageMagick's convert utility. Although the getMIMEType() function attempts to filter MIME types by truncating at the first '?' character, this insufficient sanitization fails to prevent attackers from injecting arbitrary shell commands through specially crafted filenames. Any authenticated or unauthenticated user capable of uploading media files can exploit this to achieve remote code execution with the privileges of the CMS application, making this a high-severity threat affecting all deployments of vulnerable versions.

Casky's 446 matching security skills leverage Claude's extended reasoning to detect the attack patterns associated with this vulnerability across MITRE ATT&CK's Initial Access (TA0001), Resource Development (TA0043), and Execution (TA0002) phases. Practitioners using Casky would identify suspicious indicators including: (1) unusual file uploads with special characters or command syntax in filenames targeting media endpoints, (2) unexpected child processes spawned from web service accounts executing system commands like 'convert', and (3) anomalous ImageMagick or shell command activity correlated with HTTP upload requests. The platform's skills map input validation bypass techniques (CWE-78), command injection payloads, and post-exploitation process execution patterns, enabling security teams to detect both attempted exploitation and successful compromise in real-time across logs, network traffic, and endpoint telemetry.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

446 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-70374.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-70374

Casky has 446 skills that investigate the attack patterns behind CVE-2026-70374. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn