HIGH 8.4 NVD

CVE-2026-101947

ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the s

ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped.

References

https://fluidattacks.com/advisories/saturn
https://play.google.com/store/apps/details?id=com.exiftool.free

Published: 2026-10-10 · Source: NVD · Feed updated: 2026-10-12

This high severity vulnerability with a CVSS score of 8.4 was published on 2026-10-10 via NVD.

vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.