Which versions of HRConvert2 are affected by CVE-2026-44666?

CVE-2026-44666 is a critical remote code execution vulnerability in HRConvert2 self-hosted file conversion servers that allows unauthenticated attackers to execute arbitrary commands via maliciously…. A patch is available.

How to fix or mitigate CVE-2026-44666?

Within 24 hours: Identify all HRConvert2 instances in your environment and document current versions; disable or isolate HRConvert2 from untrusted networks if feasible. Within 7 days: Implement network access controls restricting HRConvert2 to trusted users only; monitor web server logs for suspicious filename patterns (backticks, tab characters, command substitution syntax) and process activity from the www-data user context. Within 30 days: Upgrade to HRConvert2 version 3.3.8 or later immediately upon release; validate the patch in a test environment before production deployment.

HRConvert2 CVE-2026-44666

Q: What is the CVSS score of CVE-2026-44666?

CVE-2026-44666 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30480 CRITICAL

OS Command Injection (CWE-78)

2026-05-14 security-advisories@github.com

PHP Command Injection

9.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 14, 2026 - 22:02 EUVD

Source Code Evidence Fetched

May 14, 2026 - 22:01 vuln.today

Analysis Generated

May 14, 2026 - 22:01 vuln.today

CVE Published

May 14, 2026 - 21:16 nvd

CRITICAL 9.3

DescriptionGitHub Advisory

HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion server & share tool. Prior to 3.3.8, the sanitizeString() function in convertCore.php is missing backtick (`) and tab (\t) from its strip list. User input then reaches shell_exec(), where the shell interprets these characters and commands within filenames execute. This vulnerability is fixed in 3.3.8.

AnalysisAI

Remote code execution in HRConvert2 self-hosted file conversion server allows unauthenticated attackers to execute arbitrary commands via shell metacharacters in filenames. The sanitizeString() function in convertCore.php fails to filter backticks and tab characters before passing user input to shell_exec(), enabling command injection that executes in the web server context (www-data). According to the vendor, exploitation can achieve complete server takeover through two methods: backtick-based command injection or tab-based file dropping. Fixed in version 3.3.8 released May 2026. EPSS data unavailable; no confirmed active exploitation (not in CISA KEV), but the vendor confirms the vulnerability is exploitable and rates severity as critical.

Technical ContextAI

HRConvert2 is a PHP-based, self-hosted file conversion server with drag-and-drop functionality. The vulnerability stems from CWE-78 (OS Command Injection) where the sanitizeString() input validation function in convertCore.php fails to strip shell metacharacters-specifically backticks (`) and tab characters (\t)-from user-supplied input. This incomplete sanitization allows unsanitized data to reach shell_exec() calls, where the underlying shell interprets these special characters. Backticks trigger command substitution in Unix shells, causing the enclosed text to execute as a command. Tab characters can be leveraged for argument injection or file manipulation depending on the command context. The vulnerability exists in the core conversion engine, suggesting filename processing during file upload or conversion operations is the attack surface. PHP applications calling shell_exec() without proper escaping via escapeshellarg() or escapeshellcmd() are prone to this class of vulnerability.

RemediationAI

Upgrade to HRConvert2 version 3.3.8 immediately, available at https://github.com/zelon88/HRConvert2/releases/tag/v3.3.8. The vendor has implemented fixes suggested by the security researcher to properly sanitize backtick and tab characters in the sanitizeString() function. According to the GitHub Security Advisory GHSA-f74g-4wj8-j35h at https://github.com/zelon88/HRConvert2/security/advisories/GHSA-f74g-4wj8-j35h, this is the primary remediation path. If immediate patching is not possible, restrict network access to the HRConvert2 installation to trusted IP ranges only via firewall rules or web server access controls (e.g., Apache .htaccess or nginx location blocks with allow/deny directives), which reduces attack surface from AV:N to AV:A but does not eliminate the vulnerability for authenticated users. Alternatively, disable the file conversion service entirely until patching is completed, though this eliminates functionality. Do not rely on Web Application Firewall rules alone, as shell metacharacter bypasses are common and the tab character is often overlooked in WAF signatures. The vendor rates this as highly recommended urgent update due to complete server takeover potential.