CellHubs ExifTool for photo and video: OS command injection via crafted filenames
Summary
Version 5.0.1-gms of the Android app ExifTool for photo and video (package com.exiftool.free) builds a shell command from the selected media file path without proper escaping. A filename containing a single quote can break out of the argument during CSV export and run arbitrary shell commands. The commands run with the app's Android UID and permissions, so an attacker could read, change or delete files the app can access and possibly send data over the network. The attack requires a crafted file on the device and a user who selects it and runs the CSV export.
Affected
- CellHubs ExifTool for photo and video 5.0.1-gms (per the CNA record and Fluid Attacks)
- Other versions: Unknown.
Fixed in
- Version 5.0.3 or later (per Fluid Attacks; not independently confirmed on Google Play)
Workaround
- No vendor workaround known.
- Avoid the CSV export function on media whose filenames come from untrusted sources until the app is updated.
- Uninstall the app where it is not business-critical.
Exploitation
- Fluid Attacks published a proof of concept, which was not independently verified here.
- VulDB states that no exploit exists; this conflicts with the Fluid Attacks PoC.
- Not listed in KEV. No reports of in-the-wild exploitation found.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Check whether the app is installed on company and BYOD devices.
- Update to version 5.0.3 or later and verify the installed version.
- Remove the app where it is not needed.
- Warn users not to open or export files from untrusted sources with this app.
- Monitor for unusual file activity or network traffic from the app.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fluid Attacks advisory CVE-2026-101947 fluidattacks.com
- Google Play listing com.exiftool.free play.google.com
- CVE record via Vulners vulners.com
- VulDB entry CVE-2026-101947 vuldb.com
- Strix CVE-2026-101947 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:38.
Original description (NVD)
ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CSV-export path, the selected media path is merely surrounded with single quotes; embedded single quotes are not escaped.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.