CVE-2026-110650Thumbnail through 1.5 OS Command Injection via generate_thumbnail File Paths
Updated under an hour ago ()
Does this affect you?
It affects anshulkharb thumbnail. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 2.99%, higher than 87% of scored CVEs.
Do this next
Free account, 1 product
The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generate_thumbnail, such as an uploaded file, can inject commands into os.system() calls running ffmpeg, convert or unoconv with the Python process privileges.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-78
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 2.99% (percentile 87)
- Assigned by
- VulnCheck
- NVD analysis
- Deferred
- Record last updated
- Oct 14, 2026
- First seen by InfoSec Signals
- Oct 14, 2026
Affected products
anshulkharb thumbnail anshulkharb:thumbnail (from the name) | through 1.5 | CNA record |
References
- https://github.com/anshulkharb/thumbnail/pull/9patch, issue-tracking
- https://github.com/anshulkharb/thumbnail/blob/23b2e30509c936872a3bafac65b4aa48777e794c/thumbnail/thumbnail.py#L100-L114technical-description
- https://www.vulncheck.com/advisories/thumbnail-through-1.5-os-command-injection-via-generate-thumbnail-file-pathsthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.