Beveiligingsadvies

CVE-2026-55798

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-07-06 18:44:38

Laatst bijgewerkt 2026-07-07 15:19:40

Toegewezen door GitHub_M

CVSS-score 4.5

Status PUBLISHED

Beschrijving

Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0.

← Alle CVE's bekijken Bekijk op cve.org ↗