CVE-2026-44666 Details
Description
HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion server & share tool. Prior to 3.3.8, the sanitizeString() function in convertCore.php is missing backtick (`) and tab (\t) from its strip list. User input then reaches shell_exec(), where the shell interprets these characters and commands within filenames execute. This vulnerability is fixed in 3.3.8.
A critical command injection vulnerability has been identified in HRConvert2 versions prior to 3.3.8. The issue arises in the sanitizeString() function within convertCore.php, where backtick and tab characters are not properly sanitized. This oversight allows user input to be executed as commands via shell_exec(), with potential execution of arbitrary commands or dropping files into accessible locations on the server.
Users are advised to update HRConvert2 to version 3.3.8 or later. The latest version can be downloaded from the HRConvert2 GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 14, 2026CISA-ADP
Assessed May 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zelon88/HRConvert2/security/advisories/GHSA-f74g-4wj8-j35h | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/zelon88/HRConvert2/releases/tag/v3.3.8 | [email protected] | Release NotesVendor |
| https://github.com/zelon88/HRConvert2/security/advisories/GHSA-f74g-4wj8-j35h | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HRConvert2 | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 15, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | New CVE Received | [email protected] |