CVE-2026-44666: HRConvert2: Missing Sanitization enables Unauthenticated Remote Command Execution

Severity: critical (CVSS 9.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-14 · updated 2026-10-26
Weakness: CWE-78

Description

HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion server & share tool. Prior to 3.3.8, the sanitizeString() function in convertCore.php is missing backtick (`) and tab (\t) from its strip list. User input then reaches shell_exec(), where the shell interprets these characters and commands within filenames execute. This vulnerability is fixed in 3.3.8.

Affected products

zelon88 HRConvert2: before 3.3.8

References

https://github.com/zelon88/HRConvert2/releases/tag/v3.3.8
https://github.com/zelon88/HRConvert2/security/advisories/GHSA-f74g-4wj8-j35h
https://github.com/zelon88/HRConvert2/security/advisories/GHSA-f74g-4wj8-j35h

Get alerted when CVE-2026-44666 or the next vulnerability affects your stack