Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-101947 Overview
CVE-2026-101947 is an OS command injection vulnerability [CWE-78] in ExifTool for photo and video version 5.0.1-gms by CellHubs, an Android application distributed through Google Play. The application constructs shell command strings from user-selected file paths and executes them through /system/bin/sh -c. In the CSV-export code path, the selected media path is wrapped in single quotes, but embedded single quotes inside the path are not escaped. An attacker who controls a file name on the device can inject arbitrary shell commands that execute with the privileges of the ExifTool app.
Critical Impact
Local attackers can execute arbitrary shell commands within the ExifTool app context by supplying a crafted file name, leading to full compromise of app data and user media.
Affected Products
- ExifTool for photo and video by CellHubs (Android)
- Version 5.0.1-gms
- Distributed via Google Play App Details
Discovery Timeline
- 2026-10-10 - CVE-2026-101947 published to NVD
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-101947
Vulnerability Analysis
The vulnerability resides in the CSV-export workflow of ExifTool for photo and video 5.0.1-gms. The application builds a shell command string that references the media file path chosen by the user. It then invokes /system/bin/sh -c with the resulting command. The developer wrapped the file path in single quotes, assuming this would neutralize shell metacharacters. However, embedded single quote characters inside the path are passed through unmodified, which terminates the quoted argument and lets subsequent characters be interpreted as shell syntax.
Because the exploit requires local access and user interaction (the victim must trigger a CSV export against the attacker-controlled file), the attack vector is local. The impact scope is limited to the ExifTool app sandbox, but that includes access to media libraries and any app-held permissions.
Root Cause
The root cause is improper neutralization of special elements used in an OS command [CWE-78]. Single-quote wrapping is not a complete sanitization strategy for POSIX shells, because single quotes inside the data break out of the quoted context. The application should pass arguments as a parameter array to ProcessBuilder or Runtime.exec(String[]), or at minimum escape embedded single quotes using the '\'' idiom before concatenating into the command string.
Attack Vector
An attacker places a file on shared storage with a name containing a single quote and injected shell syntax, for example a filename of the form img'; <command>; '.jpg. When the victim opens ExifTool, selects that file, and triggers the CSV-export action, the constructed shell command breaks out of the quoted path and executes the attacker's payload under the app's UID. Delivery vectors include social engineering, file-sharing apps, cloud sync folders, or any other means of placing a crafted filename in a directory the user browses.
No verified public exploit code is available at this time. See the Fluid Attacks Security Advisory for additional technical context.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-101947
Indicators of Compromise
- Files on device storage with suspicious names containing single quote characters, semicolons, backticks, or shell metacharacters.
- Unexpected child processes spawned by the ExifTool app UID, particularly sh, toybox, or busybox invocations unrelated to Exif parsing.
- CSV export artifacts in app storage that reference commands or output not derived from media metadata.
Detection Strategies
- Perform mobile application code review of CSV-export routines to confirm whether file paths are passed as argument arrays rather than concatenated into shell strings.
- Monitor mobile endpoint telemetry for unexpected exec or fork activity originating from the com.exiftool.free package.
- Hunt for filenames containing shell metacharacters across managed Android devices using mobile device management (MDM) file inventory APIs.
Monitoring Recommendations
- Enable mobile threat defense logging for process creation events on managed Android fleets.
- Alert on ExifTool app launches followed closely by shell process execution.
- Track installations of com.exiftool.free across the device inventory to scope exposure.
How to Mitigate CVE-2026-101947
Immediate Actions Required
- Uninstall com.exiftool.free version 5.0.1-gms from managed and personal Android devices until a fixed release is published.
- Advise users to avoid opening media files from untrusted sources inside the ExifTool app, especially the CSV-export function.
- Audit shared storage locations synchronized from untrusted sources for filenames containing shell metacharacters.
Patch Information
No vendor patch has been published in the referenced advisory at the time of writing. Monitor the Fluid Attacks Security Advisory and the Google Play App Details listing for updated versions beyond 5.0.1-gms.
Workarounds
- Do not use the CSV-export feature in the affected version.
- Restrict the application's access to shared storage via Android per-app storage permissions.
- Replace the application with an alternative Exif metadata viewer until a patched release is available.
# Configuration example: remove the affected package from a managed Android device via adb
adb shell pm list packages | grep com.exiftool.free
adb uninstall com.exiftool.free
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
