exiftool project exiftool vulnerabilities

Latest exiftool project exiftool CVEs

Newest publication first

1. CVE-2026-3102 exiftool PNG File MacOS.pm SetMacOSTags os command injection

   Published 2026-02-24

   Medium·CVSS 5.3 EPSS 4.0%

   A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm of the component PNG File Parser. This manipulation of the argument DateTimeOriginal causes os command injection. The attack is po...

2. CVE-2022-23935 lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /|$/ check, leading to command injection.

   Published 2022-01-25

   High·CVSS 7.8 EPSS 7.6%

   lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /|$/ check, leading to command injection.

3. CVE-2021-22204 Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

   Published 2021-04-23

   High·CVSS 7.8 EPSS 100.0% CISA KEV added 2021-11-17 Exploited in the wild Framework module Public exploit PoC

   Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

4. CVE-2018-20211 ExifTool 8.32 allows local users to gain privileges by creating a %TEMP%\par-%username%\cache-exiftool-8.32 folder with a victim's username, and then copying a Trojan horse ws32_32.dll file into this....

   Published 2019-01-02

   High·CVSS 7.8 EPSS 1.4%

   ExifTool 8.32 allows local users to gain privileges by creating a %TEMP%\par-%username%\cache-exiftool-8.32 folder with a victim's username, and then copying a Trojan horse ws32_32.dll file into this new folder, aka DLL Hijacking. NOTE: 8.32 is an obsolete version from 2010 (9.x...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.