[ CVE-2026-101947 · Published 10 Oct 2026 ]
Vulnerability in CellHubs ExifTool for photo and video
CVSS 8.4
EPSS <1%No fix listed yet
[ Description ]Official description
ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.