CVE-2026-70374 is an OS Command Injection vulnerability (CWE-78) in HashBrown CMS through version 1.4.6. The issue occurs in the Media.generateThumbnail function located in src/Server/Entity/Resource/Media.js, where a temporary file path is constructed as 'thumbnail' plus the file extension from the uploaded media filename. This path is then passed unescaped into a shell command executed via AppService.exec using the 'convert' utility. Because the filename extension is not sanitized or escaped, an attacker with privileges to upload media can inject arbitrary shell commands, leading to remote code execution. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, requiring privileges but no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with privileges to upload media files to execute arbitrary OS commands on the server hosting HashBrown CMS. This can lead to full compromise of the affected system, including unauthorized data access, modification, and service disruption.

No official patch or remediation has been published by the vendor at this time. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict media upload privileges to trusted users only and consider disabling thumbnail generation if possible to reduce exposure.