HashBrown CMS through version 1.4.6 has an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. The function Media.generateThumbnail() constructs a temporary file path using the filename extension and passes it unescaped into a shell command executed via AppService.exec(). The MIME-type filter truncates extensions at the first '?' character, but Path.extname() does not, enabling an attacker to craft filenames like 'x.jpg?$(command)' that pass MIME checks but inject shell commands. An authenticated user with media resource scope can exploit this via the POST /api/{project}/{environment}/media/new endpoint to execute arbitrary OS commands in the Node.js process context.

An authenticated user with media resource scope can achieve arbitrary OS command execution on the server hosting HashBrown CMS. This could lead to full system compromise depending on the privileges of the Node.js process. The vulnerability allows execution of arbitrary commands through crafted filenames during thumbnail generation, potentially enabling data theft, service disruption, or further attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict media resource scope access to trusted users only and consider disabling or restricting the media upload functionality if possible. Monitor for updates from the HashBrown CMS vendor regarding an official fix.