Executive brief
HRConvert2 is a self-hosted file conversion and sharing tool. A security flaw allows unauthenticated remote attackers to execute arbitrary commands on the server by uploading files with specially crafted names or extensions. This could lead to a complete takeover of the server, unauthorized access to user files, and the ability to use the server as a foothold for further attacks on the internal network.
Technical details
An OS command injection vulnerability exists in HRConvert2's `convertCore.php` due to incomplete input sanitization in the `sanitizeString()` function. The function fails to strip backtick (`) and tab (\t) characters from user-supplied filenames and extensions before they are passed to the `shell_exec()` function for processing by ImageMagick. An attacker can exploit this by uploading a file with backticks in the name to execute blind commands, or by using a tab character in the extension parameter to perform a 'tab injection' that writes a persistent webshell to the webroot. This vulnerability is exploitable by unauthenticated users with network access to the application. The issue is resolved in version 3.3.8 by adding the missing characters to the sanitization strip list.
Affected products
- zelon88 HRConvert2 < 3.3.8
Timeline
- 2026-04-22: other: Vulnerability reported to vendor by KhaelK138
- 2026-05-04: patched: Version 3.3.8 released with fixes
- 2026-05-14: advisory: CVE-2026-44666 published