lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\|$/ check, leading to command injection.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade perl-image-exiftool | Aug 22, 2024 | Jan 25, 2022 |
| Amazon_linux | — | Upgrade perl-Image-ExifTool | Feb 19, 2022 | Jan 25, 2022 |
| Debian | — | Upgrade libimage-exiftool-perl | Jul 30, 2024 | Jan 25, 2022 |
| Freebsd | — | Upgrade p5-Image-ExifTool | Nov 4, 2022 | Jun 11, 2022 |
| Gentoo Linux | — | Upgrade media-libs/exiftool. | Jul 25, 2024 | Jan 25, 2022 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jan 25, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub