CVE-2026-44666 HRConvert2: Missing Sanitization enables Unauthenticated Remote Command Execution
Unauthenticated attackers can execute arbitrary commands via filenames due to missing sanitization of backticks and tabs in HRConvert2.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-44666?
CVE-2026-44666 is a critical command injection vulnerability in zelon88 HRConvert2, published on 14 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion server & share tool. Prior to 3.3.8, the sanitizeString() function in convertCore.php is missing backtick (`) and tab (\t) from its strip list. User input then reaches shell_exec(), where the shell interprets these characters and commands within filenames execute. This vulnerability is fixed in 3.3.8.
Weakness: CWE-78
Which versions are affected by CVE-2026-44666?
How do I fix CVE-2026-44666?
No fix has been published for CVE-2026-44666 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-44666 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44666 exists.
Sources
Also known as GHSA-f74g-4wj8-j35h.