CVE-2026-110650

Deferred Deferred - Pending Action

OS Command Injection in Python Thumbnail Package

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generate_thumbnail, such as an uploaded file, can inject commands into os.system() calls running ffmpeg, convert or unoconv with the Python process privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110650

EUVD

EUVD-2026-101278

Affected Vendors & Products

Vendor	Product	Version / Range
anshulkharb	thumbnail	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-110650 is an OS command injection vulnerability in the thumbnail Python package through version 1.5. The flaw exists in the generate_thumbnail() function where user-controlled file paths are directly concatenated into shell commands executed via os.system(). Attackers can inject shell metacharacters like semicolons or backticks into filenames to execute arbitrary commands with the Python process privileges.

Detection Guidance

To detect this vulnerability, inspect Python applications using the thumbnail package version 1.5 or earlier. Check for use of os.system() in generate_thumbnail() functions and validate if file paths or options are passed unsafely. Review logs for suspicious filenames containing shell metacharacters like semicolons, backticks, or command substitutions.

Impact Analysis

If you use the thumbnail package up to version 1.5, attackers who control file names passed to generate_thumbnail() could execute arbitrary commands on your system. This could lead to data theft, system compromise, or unauthorized actions, depending on the privileges of the Python process.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Immediately upgrade the thumbnail package to a version that replaces os.system() with subprocess.run() using an argument list. If upgrading is not possible, modify the generate_thumbnail() function to sanitize inputs and avoid shell=True in subprocess calls. Remove or restrict user control over filenames and options passed to the function.

Hi! I’m here to help you understand CVE-2026-110650. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70