CVE-2026-101947

Name of the Vulnerable Software and Affected Versions ExifTool for photo and video version 5.0.1-gms

Description The application constructs shell command strings using file paths and executes them via /system/bin/sh -c. During the CSV-export process, the selected media path is enclosed in single quotes without escaping embedded single quotes, which allows for command injection.

Recommendations Update ExifTool for photo and video to a version where file paths are properly sanitized or escaped before being passed to the shell.