CVE-2026-101947
Received Received - Intake

ExifTool Command Injection via CSV Export Path

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: Fluid Attacks

Description
ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-10
Last Modified
2026-10-10
Generated
2026-10-10
AI Q&A
2026-10-10
EPSS Evaluated
N/A
NVD
CVE-2026-101947
EUVD
EUVD-2026-96030

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
CellHubs ExifTool for photo and video 5.0.1-gms

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ExifTool for photo and video 5.0.1-gms by CellHubs has a local OS command injection vulnerability in its CSV export feature. When exporting metadata, the app constructs shell commands from file paths but fails to properly escape single quotes in filenames. This allows attackers to inject arbitrary shell commands by using filenames containing apostrophes and malicious syntax.

Detection Guidance

Check for files with apostrophes in their names, especially in directories where ExifTool for photo and video accesses media. Monitor command execution logs for unexpected shell commands from the app. Review CSV export outputs for unusual file paths or commands.

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute arbitrary commands on your device with the same privileges as the ExifTool app. This may lead to unauthorized file access, modification, or data theft over the network. Attackers could trick you into selecting a malicious file for export to trigger the exploit.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using this app may face compliance breaches if user data is compromised due to the flaw.

Mitigation Strategies

Avoid using the CSV export feature in ExifTool for photo and video until a patch is available. Do not open or export metadata from files with apostrophes in their names. Consider uninstalling the app if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101947. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart