MajorCritical vulnerability
CVE-2026-101947 (CVSS 8.4)
NVD · officialPublished Oct 10, 2026Risk 37/100
ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped.
Technical details
CVSS
8.4
AV:LocalAC:LowPR:NoneUI:Active
Evidence and sources
This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source