Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-110650: Thumbnail package lets attackers run commands via crafted file names
CVE-2026-110650 · published 1 day ago
Summary
The Python thumbnail library (up to version 1.5) can be tricked into executing any system command when it processes a file name that contains special characters. This means a malicious user could cause the program to run unwanted commands with the same rights as the application. Update to a newer, patched version of the library or ensure that only trusted, sanitized file names are passed to the generate_thumbnail function.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| anshulkharb | thumbnail | <= 1.5 |
Original advisory text
Thumbnail through 1.5 OS Command Injection via generate_thumbnail File Paths
The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generate_thumbnail, such as an uploaded file, can inject commands into os.system() calls running ffmpeg, convert or unoconv with the Python process privileges.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Severity
9.3
Critical
Type
CWE-78OS Command Injection
Timeline
Published14 Oct 2026
Updated15 Oct 2026
First seen14 Oct 2026
Track software like this
Free during beta