BaseFortify

Publication date: 2026-05-14

Last updated on: 2026-05-15

Assigner: GitHub, Inc.

Description

HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion server & share tool. Prior to 3.3.8, the sanitizeString() function in convertCore.php is missing backtick (`) and tab (\t) from its strip list. User input then reaches shell_exec(), where the shell interprets these characters and commands within filenames execute. This vulnerability is fixed in 3.3.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-14

Last Modified

2026-05-15

Generated

2026-06-30

EPSS Evaluated

2026-06-28

NVD

CVE-2026-44666

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions have not been generated yet.

Hi! I’m here to help you understand CVE-2026-44666. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70