CVE-2026-70375 is a command injection vulnerability in HashBrown CMS's Git deployer module. The branch parameter in the pullRepo() function is interpolated directly into a shell command for git checkout without sanitization. This is not a new vulnerability—it is the unpatched remainder of CVE-2020-6948, which addressed the same injection pattern in the repo, username, and password fields but left the branch field untouched.
The critical distinction between this and a typical command injection is the trigger mechanism. This does not require an attacker to manually execute anything. Once a malicious branch value is configured in the deployer settings, it executes automatically on every CMS operation that triggers a deploy—media uploads, content saves, any workflow event that invokes the deployer. This converts a vulnerability that would normally require repeated attacker presence into a persistent backdoor. A single compromised account or malicious insider sets the branch once, and every subsequent deployment operation on that system executes attacker-controlled code.
The fix path is straightforward at the implementation level: replace shell string interpolation with subprocess arguments passed as a list and shell=False. This eliminates the entire injection class regardless of what the branch string contains, because the shell is never invoked. The 2020 partial fix addressed specific characters (single quotes) in specific fields, which is the symptom-suppression pattern—patching exploit strings rather than the vulnerability class. That approach predictably left adjacent injection points exposed.
The missing variable that determines actual severity is access control. Determine whether configuring Git deployer settings requires administrator privileges or is available to any authenticated CMS user. If any authenticated user can set deployer configuration, this is a privilege escalation vector from the CMS application account to host-level command execution—a horizontal escalation in multi-tenant environments. If it requires admin access, the vulnerability functions primarily as an insider threat or post-exploitation pivot, which narrows the blast radius substantially but does not eliminate the risk.
Check your logging and compensating controls around deployer configuration. Organizations that trusted the CVE-2020-6948 remediation may have removed monitoring or approval workflows for branch changes under the assumption the injection risk was eliminated. Validate that configuration change logging exists and review recent modifications to deployer settings.