{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3astillsstills/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:stills:stills:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-110649"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Stills (\u003c 25.24.2)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","command-injection","rce","webserver"],"_cs_type":"advisory","_cs_vendors":["Stills"],"content_html":"\u003cp\u003eStills versions prior to 25.24.2 contain an OS command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands on the underlying host. The vulnerability exists because the application improperly sanitizes file paths before passing them to external media processing utilities, specifically ffmpeg, ffprobe, gifsicle, and ImageMagick's convert. By creating or supplying media files with malicious paths containing shell metacharacters such as $(...) or backticks, an attacker can cause the host system to interpret these sequences as shell commands. Because these utilities are invoked by the application's runtime, the injected commands execute with the same privileges as the Node.js process. This flaw poses a significant risk to the integrity and availability of the hosting environment, as it facilitates remote code execution without the need for authentication.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target application utilizing Stills for media processing.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious filename or directory structure containing command injection metacharacters (e.g., \u003ccode\u003e$(whoami).jpg\u003c/code\u003e or \u003ccode\u003e`rm -rf /`.jpg\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAttacker uploads or causes the application to reference the malicious media file path.\u003c/li\u003e\n\u003cli\u003eThe Stills application receives the path and fails to sanitize the shell metacharacters.\u003c/li\u003e\n\u003cli\u003eThe application invokes a system utility (ffmpeg, ffprobe, gifsicle, or convert) using the unsanitized path as an argument.\u003c/li\u003e\n\u003cli\u003eThe operating system shell interprets the metacharacters within the filename.\u003c/li\u003e\n\u003cli\u003eThe injected shell command executes with the privileges of the Node.js process.\u003c/li\u003e\n\u003cli\u003eAttacker achieves remote code execution for potential data exfiltration or system compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows for arbitrary command execution on the host server. This could lead to full system compromise, exfiltration of sensitive configuration data, or lateral movement within the environment. As the vulnerability allows command execution at the privilege level of the application process, it represents a critical risk to any infrastructure running an affected version of Stills.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for detection and remediation:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ePatch Stills by upgrading to version 25.24.2 or later immediately to address CVE-2026-110649.\u003c/li\u003e\n\u003cli\u003eAudit application logs for abnormal filename patterns, specifically those containing shell metacharacters such as \u003ccode\u003e$\u003c/code\u003e, \u003ccode\u003e(\u003c/code\u003e, \u003ccode\u003e)\u003c/code\u003e, or backticks, in paths processed by ffmpeg, ffprobe, gifsicle, or convert.\u003c/li\u003e\n\u003cli\u003eEnsure that the Node.js process running Stills operates with the least privilege necessary to limit the scope of impact if an injection vulnerability is exploited.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T16:34:12Z","date_published":"2026-10-14T16:34:12Z","id":"https://feed.craftedsignal.io/briefs/2026-10-stills-command-injection/","summary":"Stills versions prior to 25.24.2 are vulnerable to OS command injection via crafted media file paths containing shell metacharacters, enabling arbitrary command execution with Node.js process privileges.","title":"OS Command Injection in Stills via Crafted Media File Paths","url":"https://feed.craftedsignal.io/briefs/2026-10-stills-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:stills:stills:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}