CVE-2026-110649: Stills before 25.24.2 OS Command Injection via Media File Names
Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert runs.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using Stills before 25.24.2 are exposed when they process media files whose paths or names can be influenced by an attacker. The affected processing paths invoke ffmpeg, ffprobe, gifsicle, or convert.
What does an attacker need to exploit it?
An attacker needs to supply or cause the application to process a media file with a crafted name or path containing shell command substitution syntax such as $(...) or backticks. No authentication or user interaction is required according to the supplied severity vector.
What level of access could successful exploitation provide?
Injected commands execute with the privileges of the Node.js process running Stills. The provided severity vector indicates potential high impact to confidentiality, integrity, and availability.
How can I determine whether my deployment may be affected?
Check whether the deployed Stills version is earlier than 25.24.2 and whether it processes media filenames or paths from untrusted sources. Review media filenames and processing inputs for shell substitution characters, including $(...) and backticks.