CVE-2026-70374

HashBrown CMS prior to 1.4.6 is affected by an OS command injection in the media thumbnail generation flow. Media.generateThumbnail() builds a temporary path like 'thumbnail' + extname(filename) and passes it unescaped into a shell command executed by AppService.exec() (example: 'convert ' + temp...