Description
A command injection vulnerability in the video thumbnail rendering component of files.photo.gallery v0.3.0 through 0.11.0 allows remote attackers to execute arbitrary code via a crafted video file.
Recommendation
No fix is available yet. Followings are affected versions:
- >= 0.3.0, <= 0.11.0
References
Could your website be exposed too?
SmartScanner can check your website for files.photo.gallery command injection and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Command injection in github-todos - CVE-2021-44684
- [Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat - @theia/ai-claude-code - CVE-2026-46580
- [Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat - @theia/ai-code-completion - CVE-2026-46580
- [Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat - @theia/ai-core - CVE-2026-46580
You might also like:
See something that needs correcting? Let us knowUpdated February 06, 2025