CVE-2026-110650: Thumbnail through 1.5 OS Command Injection via generate_thumbnail File Paths
The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generatethumbnail() that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generatethumbnail, such as an uploaded file, can inject commands into os.system() calls running ffmpeg, convert or unoconv with the Python process privileges.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the thumbnail Python package through version 1.5 are exposed if they pass attacker-controlled file paths or file names to generate_thumbnail(). Uploaded files are an example of an attacker-controlled input source.
What does an attacker need to exploit this issue?
An attacker needs to supply a file path or name containing shell metacharacters that is passed to generate_thumbnail(). No authentication or user interaction is required according to the supplied severity vector.
What level of access could successful exploitation provide?
Injected commands run with the privileges of the Python process that invokes generate_thumbnail(). The reported impact includes high confidentiality, integrity, and availability impact.
What can be done if updating is not immediately possible?
Do not pass untrusted file names or paths to generate_thumbnail(). Restrict thumbnail generation to server-generated, validated paths and remove or reject shell metacharacters in any input that can influence those paths.