Key points
- CVE-2026-110649 affects Stills versions prior to 25.24.2 with a CVSS score of 9.3.
- Attackers can execute shell commands by supplying media file paths containing shell syntax.
- The vulnerability enables command execution with Node.js process privileges via ffmpeg or convert.
A critical operating system command injection vulnerability exists in the Stills media processing tool. The National Vulnerability Database confirms that versions before 25.24.2 are affected by this flaw, which carries a CVSS score of 9.3.
What happened
The vulnerability, tracked as CVE-2026-110649, allows attackers to execute shell commands by supplying crafted media file paths. According to the National Vulnerability Database, the weakness is classified under CWE-78.
Attackers can exploit this by naming media files using dollar-sign parentheses or backticks. When Stills processes these files, it passes the paths to external tools such as ffmpeg, ffprobe, gifsicle, or convert. These tools then execute the embedded commands with the privileges of the Node.js process.
Why it matters
This flaw allows attackers to execute operating system commands with Node.js process privileges. The impact is severe because the executed commands run with the same privileges as the Node.js process. This could allow an attacker to execute commands on the system running the media processor.
The National Vulnerability Database rates the severity as critical. Organisations using Stills for media processing are directly exposed if they accept file paths from untrusted sources. The ability to inject commands via file names makes this a high-risk vector for command execution.
What happens next
- Identify all instances of Stills running versions prior to 25.24.2 in your environment.
- Verify whether the application processes media files from external or untrusted inputs.
- Plan an immediate upgrade to version 25.24.2 or later to mitigate the risk.
- Monitor system logs for unexpected command executions or anomalies in Node.js processes.
Patch priority
Teams should prioritise updating systems that expose Stills to external users or untrusted file inputs. Check whether the application accepts media paths from web forms or API endpoints. Roll out the fix to internet-facing instances first, as they face the highest exposure risk. Test the update in a staging environment to ensure compatibility with existing media workflows. Back up configuration files before applying changes. If immediate patching is not possible, restrict input validation to block shell metacharacters in file names. Monitor for unusual process activity that might indicate exploitation attempts.
What to do and how to stay safe: Stills
- Audit your inventory for Stills installations running versions older than 25.24.2.
- Implement strict input validation to reject file paths containing shell syntax like backticks.
- Restrict the Node.js process permissions to limit the impact of potential command injection.
- Monitor application logs for signs of unexpected command executions or failed process calls.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Stills are affected by CVE-2026-110649?
All versions of Stills before 25.24.2 are affected by this critical vulnerability.
How can an attacker exploit this vulnerability?
Attackers can supply crafted media file paths containing shell syntax like $(...) or backticks.
What is the CVSS score for this vulnerability?
The National Vulnerability Database assigns a CVSS score of 9.3 to CVE-2026-110649.
