CVE-2026-70375

HashBrown CMS <= 1.4.6 contains an OS Command Injection in the Git deployer (GitDeployer.pullRepo) where the branch value is interpolated into a shell command: git checkout ${this.branch || 'master'}. Validation only rejects single quotes; shell metacharacters such as ;, &&, |, backticks, and ...