HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the media upload thumbnail generation routine. The vulnerability arises when Media.generateThumbnail builds a temporary file path as 'thumbnail' plus the file extension and passes it without proper escaping into a shell command executed via AppService.exec. This flaw allows an attacker to inject arbitrary OS commands via a crafted filename during media upload.

The affected product is HashBrownCMS (hashbrown-cms) through version 1.4.6. No other vendors or products are listed in the CNA data.

The flaw is highly critical and permits remote code execution for any authenticated user possessing the media resource scope. Based on the description, it is inferred that the attacker must be authenticated to access the media upload endpoint, and the attack vector is an authenticated POST to /api/{project}/{environment}/media/new with a malicious filename. The EPSS score, now noted as < 1%, indicates a very low but nonzero probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 8.8 underscores the high severity, and the lack of mitigation in the affected release confirms a high to critical risk.