CVE-2026-101947: ExifTool for photo and video 5.0.1 - Local OS command injection through filenames during CSV export

Published Oct 10, 2026

Updated

ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped.

Affected Software

1 affected component

CellHubs ExifTool for photo and video=5.0.1-gms

Event History

Oct 10, 2026

CVE Published

via MITRE·03:06 AM

Data Sourced

via MITRE·03:06 AM

DescriptionWeakness

Data Sourced

via NVD·04:18 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What user action is required for exploitation?

A user must use the CSV export path with a selected media file whose path contains embedded single quotes. The vulnerable command construction is triggered during that export operation.

Does an attacker need prior access or privileges on the device?

The vector is local and the CVSS data indicates no privileges are required, but user interaction is required. An attacker would need to get a crafted filename or path onto the device and induce the user to select it for CSV export.

Are normal CSV exports affected?

The described flaw depends on embedded single quotes in the selected media path. The provided data does not indicate that paths without single quotes break out of the shell quoting.

What is the immediate mitigation if an update is unavailable?

Avoid CSV export for media files with untrusted or unusual filenames, particularly names containing single quotes. Rename or remove such files before exporting metadata.

CVE-2026-101947: ExifTool for photo and video 5.0.1 - Local OS command injection through filenames during CSV export

Affected Software

Event History

Frequently Asked Questions

What user action is required for exploitation?

Does an attacker need prior access or privileges on the device?

Are normal CSV exports affected?

What is the immediate mitigation if an update is unavailable?

Company

Resources

Contact

Frequently Asked Questions

What user action is required for exploitation?

Does an attacker need prior access or privileges on the device?

Are normal CSV exports affected?

What is the immediate mitigation if an update is unavailable?