A critical OS command injection flaw in Stills allows attackers to run shell commands via crafted file paths, requiring an immediate update for users.
Key points
- Stills versions before 25.24.2 contain a critical OS command injection vulnerability.
- Attackers can execute operating system commands by naming media files with special characters.
- The flaw runs commands with Node.js process privileges when tools like ffmpeg execute.
Stills media processing software contains a critical vulnerability that allows attackers to execute arbitrary operating system commands. The flaw exists in versions prior to 25.24.2 and is triggered by supplying crafted media file paths to the application.
What happened
The National Vulnerability Database records CVE-2026-110649 as a critical issue with a CVSS score of 9.3. The vulnerability affects Stills software developed by shahkashani. According to the NVD record, the flaw allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file using dollar signs with parentheses or backticks. This trick causes the operating system to interpret the filename as a command rather than a simple path.
When tools such as ffmpeg, ffprobe, gifsicle, or convert run, they execute these commands with Node.js process privileges. This means the attacker gains the same access rights as the application itself. The issue is classified under CWE-78, which covers OS command injection weaknesses. No other details regarding active exploitation or specific victims are provided in the source material.
Why it matters
The fix
- Update Stills to version 25.24.2 or later immediately.
- Verify that all installations have received the patch.
- Monitor logs for unusual command execution attempts.
- Restrict file naming conventions if possible.
Why it matters
OS command injection occurs when an application passes user input directly to a system shell without proper sanitization. This allows attackers to inject malicious commands that the server executes. Teams usually validate and escape all user-supplied data before passing it to system functions. Check whether your organization’s media processing tools sanitize file paths and names. Ensure that applications run with the least privilege necessary to limit potential damage. Regularly review code for unsafe function calls that interact with the operating system. This guidance helps prevent similar vulnerabilities in other software components.
What to do and how to stay safe: Stills
- Check your current Stills version and update to 25.24.2 or newer.
- Audit media processing workflows for untrusted file inputs.
- Monitor system logs for unexpected command executions.
- Educate users on the risks of handling malformed media files.
Step-by-step guide: Patch Testing: How to Verify Fixes Without Breaking Your Systems
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-110649?
It is a critical OS command injection vulnerability in Stills software before version 25.24.2.
How is the vulnerability exploited?
Attackers supply crafted media file paths using special characters like backticks or dollar signs.
Which tools are affected by this flaw?
The vulnerability impacts ffmpeg, ffprobe, gifsicle, and convert when they run within Stills.
