CVE-2026-101947

UNKNOWN

Description

ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped.

Timeline

Published:October 10th, 2026 4:18 AM

Last modified:October 15th, 2026 7:17 PM

CVSS Scoring

No CVSS v3 score available

Weaknesses (CWE)

CWE-78

References & Reports

Advisories, patches, and third-party reports

https://fluidattacks.com/advisories/saturn
https://play.google.com/store/apps/details?id=com.exiftool.free

Source: NIST NVD · Data may lag official sources by up to one minute