HashBrownCMS vulnerabilities
We track 2 vulnerabilities in HashBrownCMS products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 5, 2026.
2vulnerabilities
0critical
2high
0exploited
8.8average CVSS score
Latest HashBrownCMS vulnerabilities
- 8.8 High severity
hashbrown-cms: Improper Neutralization of Special Elements used in an OS Command
HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly in
- 8.8 High severity
hashbrown-cms: Improper Neutralization of Special Elements used in an OS Command
HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extname(file