by Kastro
Paper/Archive/CVE-2026-44666

CVE-2026-44666

zelon88 HRConvert2 — HRConvert2: Missing Sanitization enables Unauthenticated Remote Command Execution

EPSS 0.4%public exploitCVSS 9.3
critical.is priorityof 100
44
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 31.6.316 × 206.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion server & share tool. Prior to 3.3.8, the sanitizeString() function in convertCore.php is missing backtick (`) and tab (\t) from its strip list. User input then reaches shell_exec(), where the shell interprets these characters and commands within filenames execute. This vulnerability is fixed in 3.3.8.

Affected

ProductAffectedFixed inSource
HRConvert2< 3.3.8–CNA

Scores by source

GitHub_M (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/zelon88/HRConvert2/security/advisories/GHSA-f74g-4wj8-j35hrefgithub.com/zelon88/HRConvert2/releases/tag/v3.3.8