CVE-2026-44666CWE-78

HRConvert2: Missing Sanitization enables Unauthenticated Remote Command Execution

Critical · published May 14, 2026

CVSS v4.0
9.3
EPSS
0%
Percentile
39.0
In the wild
Unconfirmed
What it is

HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion server & share tool. Prior to 3.3.8, the sanitizeString() function in convertCore.php is missing backtick (`) and tab (\t) from its strip list. User input then reaches shell_exec(), where the shell interprets these characters and commands within filenames execute. This vulnerability is fixed in 3.3.8.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
EPSS
0.00461 · 39.0th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-05-14T20:32Z
EPSS history
Timeline
  • 14 MAY 20:32Z
    HRConvert2: Missing Sanitization enables Unauthenticated Remote Command Execution
    cvelistv5