Threats tagged 'ghsa-fwcv-c88q-m2pm'

CVE-2026-101947 is a high-severity OS command injection vulnerability in CellHubs ExifTool for photo and video version 5.0.1-gms. The vulnerability arises because the software constructs shell command strings from file paths without properly escaping embedded single quotes, specifically in the CSV-export functionality. This improper neutralization of special elements (CWE-78) allows an attacker to inject arbitrary commands via crafted file paths. The vulnerability requires local access with user interaction and has no known exploits in the wild.