CVE-2026-70375 Details

A command injection vulnerability allowing OS command execution has been identified in HashBrown CMS versions through 1.4.6, specifically within the Git deployer component. The issue arises because the GitDeployer.pullRepo() method executes a shell command to check out a specified branch, directly interpolating the branch value without proper escaping. While the validate() method of GitDeployer rejects single-quote characters in certain fields, it fails to filter out other shell metacharacters, such as semicolons, ampersands, pipes, backticks, and command substitution syntax. This oversight allows users to inject malicious commands that are executed during deployment operations, as pullRepo() is automatically called at the start of each media upload or content save process.