Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2022-23935: lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\|$/ check, leading to command injection.
CVE-2022-23935 · published 4 years ago
Summary
lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\|$/ check, leading to command injection.
What to do
- Update debian libimage-exiftool-perl to version 12.38+dfsg-1.
- Update exiftool_project exiftool to version 12.38 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | exiftool_project | exiftool |
< 12.38 cpe:2.3:a:exiftool_project:exiftool:*:*:*:*:*:*:*:* |
| Debian:12 | debian | libimage-exiftool-perl |
< 12.38+dfsg-1 Fix: upgrade to 12.38+dfsg-1
|
Original advisory text
lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\|$/ check, leading to command injection.
lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\|$/ check, leading to command injection.
References
- https://gist.github.com/ert-plus/1414276e4cb5d56dd431c2f0429e4429 URL
- https://github.com/exiftool/exiftool/commit/74dbab1d2766d6422bb05b033ac6634bf8d1... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23935... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-23935 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2022-23935 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-78OS Command Injection
Timeline
Published25 Jan 2022
Updated21 Oct 2026
First seen29 Sep 2026
Track software like this
Free during beta