CVE-2026-70374

This CVE is a command injection, but it's structurally distinct from the typical case where an attacker defeats a security filter. The real issue is a silent divergence between two functions that were never designed to work together as a security boundary. getMIMEType() strips query strings by truncating at '?', while Path.extname() was written without any consideration for shell command construction. The attacker doesn't bypass a check—they exploit the gap between two functions that serve different purposes but get chained in a security-relevant way. This is the 'dual-parser divergence' pattern, and it's well-documented in CVE lineages: patches that harmonize parsing behavior while leaving the exec() call intact get bypassed within 18 months through a different parsing disagreement elsewhere. Check whether your deployment's patch refactored the exec() call to use execFile() with array arguments, or merely added '?' handling to Path.extname(). The former breaks the pipeline entirely; the latter leaves the architectural flaw intact and the assumption that 'extension strings are safe because they passed MIME validation' living on in every other Path.extname() consumer throughout the codebase. You cannot verify complete remediation without seeing the patched source—the CVE description doesn't disclose which approach was taken. The privilege requirement matters. 'Media resource scope' in CMS architectures typically maps to content creators and editors, not administrators. A successful exploit gives you Node.js process context in an application that stores database credentials and external service keys. The CVSS 8.8 captures technical severity but understates the collateral damage if an attacker with mid-tier access reaches those stored credentials. Detection is difficult. SAST tools won't flag Path.extname() as dangerous because it's Node.js core—assumed safe. DAF won't catch this because exploitation requires a crafted filename, not a malformed HTTP payload. Post-exploitation, check your thumbnail generation logs for command injection artifacts in the argv strings passed to the subprocess.

Reviewed through automated stages and approved by a human before publication.