Stills Media Processor Vulnerable to Critical OS Command Injection via File Paths
Attackers can execute arbitrary shell commands in Stills versions before 25.24.2 by naming media files with special characters that trigger command execution.
Key points
- The flaw allows remote code execution with Node.js process privileges.
- Crafted filenames using subshells or backticks trigger the injection.
- Versions of Stills prior to 25.24.2 are affected by this critical issue.
The Stills media processing tool contains a critical operating system command injection vulnerability. Security researchers identified that attackers can execute arbitrary shell commands by supplying crafted media file paths to the application. This flaw exposes environments running Stills before version 25.24.2 to potential full system compromise if the tool processes untrusted files.
Root cause
The vulnerability stems from improper handling of user-supplied file paths within the application logic. According to the National Vulnerability Database record for CVE-2026-110649, the application passes these paths directly to external command-line tools without sufficient sanitization. This design error allows the operating system to interpret special characters within filenames as executable commands rather than simple text strings, leading to unintended code execution.
Attack path
An attacker initiates the exploit by creating a media file with a specially crafted name. The filename includes shell metacharacters such as dollar signs with parentheses or backticks. When the Stills application processes this file, it invokes external utilities like ffmpeg, ffprobe, gifsicle, or convert. These tools then execute the injected commands with the same privileges as the Node.js process running the application.
Affected versions
- Stills versions prior to 25.24.2 are vulnerable.
- The issue is tracked as CVE-2026-110649.
- The Common Weakness Enumeration classifies this as CWE-78.
Mitigation
- Upgrade Stills to version 25.24.2 or later immediately.
- Restrict file input to trusted sources only.
- Implement strict filename validation on the server side.
- Monitor logs for unexpected command execution patterns.
Detection notes
Security teams should monitor process creation logs for unexpected invocations of media processing tools like ffmpeg or convert. Look for shell metacharacters in file access logs or argument lists associated with the Node.js process. Check for outbound network connections from the application server that do not match normal operational patterns. If suspicious activity is detected, isolate the affected host to prevent lateral movement and preserve forensic evidence.
What to do and how to stay safe: Stills
- Verify your current Stills version and upgrade if it is below 25.24.2.
- Audit file upload endpoints to ensure they reject filenames containing shell operators.
- Review server logs for any recent execution of media tools with unusual arguments.
- Implement network segmentation to limit the impact of a compromised application server.
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for this vulnerability?
The National Vulnerability Database rates CVE-2026-110649 as 9.3, which is considered critical.
Which external tools are involved in the exploit?
The attack leverages ffmpeg, ffprobe, gifsicle, or convert when they process the malicious file paths.
Is there a patch available for this issue?
Yes, updating Stills to version 25.24.2 or later resolves the vulnerability.
