Threats tagged 'ghsa-f8rj-8x92-pfp5'

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
High	8.8	EPSS 1.9%	CVE-2026-70374HashBrownCMS hashbrown-cms · OS Command Injection High8.8EPSS 1.9%2026-08-05CVE Database V5CVE-2026-70374 HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extname(filename) and passes it, unescaped, into a shell command executed via AppService.exec ('convert ' + tempFile + ...). EPSS 1.9%Vulnerability CWE-78 #ghsa-f8rj-8x92-pfp5	CVE Database V5	2026-08-05

Page 1 of 1