CVE-2026-110649

Summary

This vulnerability allows attackers to execute arbitrary shell commands on a system by manipulating media file names with command injection syntax like $(...) or backticks. The flaw is particularly dangerous because it runs with Node.js process privileges, potentially enabling full system compromise.

Exploitability

Exploitation is relatively straightforward requiring only the ability to upload or process a specially named media file, with no additional authentication needed for the vulnerable function.

Blast radius

If exploited, attackers could gain complete control of the system running the Stills application, potentially leading to data exfiltration, lateral movement, or complete system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Stills 25.24.2 or later to remediate this OS command injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.