ANALYSIS · 52a7ff7e· FINISHED 2026-05-27 · PATCHDIFF

exiftool-rce-202613.49 → 13.50✓ COMPLETED

Files19

Vulnerable4

True positives3

CVE matched1

1 CVE article ready PatchLeaks generated full security writeups for the matched CVEs · one per CVE, with affected files linked

CVE-2026-3102

FILTERS 0

SEARCH

STATUS

JUDGE

CVE MATCH

EXTENSION

CWE

OPTIONS

Hide “No vulnerability” Hide unjudged

SCOPE

All 19 CVE 1 Vuln 4

SORT

1 files · page 1/1

lib/Image/ExifTool/MacOS.pm

AI: 1 vulnerabilities

CVE-2026-3102 1 TP

#%!d(float64=010)

1–1 of 1

⌖

Select a file from the list to inspect its diff and AI analysis.

↑ ↓ to navigate

CVES 1

CVE-2026-3102

Security writeup for CVE-2026-3102

✓ 1 FILE

## 1. Vulnerability Background

What is this vulnerability?
- CVE-2026-3102 is a command injection flaw in ExifTool on macOS.
- The vulnerable code is in `lib/Image/ExifTool/MacOS.pm`, specifically the `SetMacOSTags` routine of the PNG parser.
- Metadata extracted from a PNG file — notably `DateTimeOriginal` — is used to build shell commands without sufficient protection.

Why is it critical/important?
- ExifTool is often used in automated image-processing pipelines and security tools.
- A remote attacker who can supply a crafted PNG file may trigger code execution on a macOS host.
- The flaw affects execution of native utilities such as `/usr/bin/setfile`, `/usr/local/bin/tag`, `/usr/bin/xattr`, and `/usr/bin/osascript`.
- Arbitrary command execution in a file-processing component is high severity because it compromises the host running the parser.

What systems/versions are affected?
- Affects ExifTool versions up to and including 13.49 on macOS.
- Fixed in ExifTool 13.50.
- The affected component is the macOS-specific tag-handling code in `MacOS.pm`.

## 2. Technical Details

Root cause analysis
- The root cause is unsafe shell command construction using untrusted metadata values.
- In the vulnerable implementation, `SetMacOSTags` interpolates variables like `$val`, `$file`, `$del`, and `$tag` into strings passed to `system`.
- Examples from the old code:
  - `/usr/bin/setfile -d '${val}' '${f}'`
  - `/usr/local/bin/tag -r '${del}' '${f}'`
  - `/usr/local/bin/tag $opt '${val}' '${f}'`
  - `/usr/bin/xattr -d $delXAttr{$tag} '${f}'`
  - `/usr/bin/osascript -e '... "$v"'`
- These commands were executed through the shell, so attacker-controlled metadata containing shell metacharacters could break the intended command and inject new commands.

Attack vector and exploitation conditions
- The attack vector is a crafted PNG file with malicious metadata in `DateTimeOriginal` or equivalent tags that reach `SetMacOSTags`.
- The vulnerable code path is only on macOS and when ExifTool is asked to set macOS file tags.
- The exploit requires that ExifTool processes attacker-controlled input and is run with sufficient privileges to execute the underlying utilities.
- Because ExifTool is often used in services handling uploaded images, this is effectively remote code execution from the attacker’s perspective.

Security implications
- Arbitrary command execution as the user running ExifTool.
- Potential compromise of the host running a file-processing service.
- Unauthorized creation, modification, or deletion of files.
- Possible privilege escalation if ExifTool runs in a privileged context.
- Persistence and lateral movement from a compromised image-handling node.

## 3. Patch Analysis

What code changes were made?
- Introduced a helper subroutine `System`:
  - redirects `STDOUT` and `STDERR` to `/dev/null`
  - invokes `system(@_)`
  - restores standard output/error
- Replaced shell-command string construction with argument lists:
  - `push @cmd, '/usr/bin/setfile', '-d', $val, $file;`
  - `System('/usr/local/bin/tag', '-r', $del, $file);`
  - `push @cmd, '/usr/local/bin/tag', $opt, $val, $file;`
  - `push @cmd, '/usr/bin/xattr', '-d', $delXAttr{$tag}, $file;`
- For AppleScript invocations, escaped quotes and backslashes in the file path:
  - `($f = $file) =~ s/([\\"])/\\$1/g;`
  - used list-form `system` with `-e` arguments rather than a shell string.

How do these changes fix the vulnerability?
- Passing arguments as a list to `system()` avoids shell interpretation.
- Unsafe characters in `$val` or `$file` are treated as literal arguments, not as command syntax.
- Shell metacharacters such as `;`, `&`, `|`, `` ` ``, and `$(...)` no longer cause command injection.
- The `osascript` branch is hardened by escaping quotes and backslashes before constructing AppleScript source text.

Security improvements introduced
- safer command invocation model
- elimination of untrusted-shell string execution
- consistent output suppression while preserving behavior
- reduced risk of future metadata-based injection in the macOS tag path

## 4. Proof of Concept (PoC) Guide

Prerequisites for exploitation
- macOS host.
- ExifTool version 13.49 or earlier.
- An attacker-controlled PNG file with metadata.
- A processing path that triggers `SetMacOSTags` during ExifTool execution.

Step-by-step exploitation approach
1. Create or modify a PNG file to include a malicious `DateTimeOriginal` metadata value.
2. Use a payload containing shell metacharacters, for example:
   - `2026:01:01 00:00:00'; touch /tmp/exploit_success; #'`
3. Feed the file to ExifTool in a way that invokes macOS tag handling.
4. Observe whether the injected command is executed.

Expected behavior vs exploited behavior
- Expected behavior:
  - ExifTool processes the image.
  - macOS metadata commands run only with legitimate arguments.
  - No unexpected file system changes occur.
- Exploited behavior:
  - The malicious payload is interpreted by the shell.
  - Additional commands execute, e.g. creation of `/tmp/exploit_success`.
  - ExifTool may appear to succeed while side effects occur.

How to verify the vulnerability exists
- Confirm ExifTool version is <= 13.49.
- Supply a crafted PNG with malicious metadata.
- Check for side effects from injected commands.
- If side effects occur, the host is vulnerable.
- On a patched system (13.50+), the same payload should not result in command execution.

## 5. Recommendations

Mitigation strategies
- Upgrade ExifTool to version 13.50 or later immediately.
- If upgrade is not immediately possible:
  - avoid processing untrusted files with macOS metadata features
  - run ExifTool in a sandboxed or restricted environment
  - enforce least privilege for the user executing ExifTool
  - limit access to `/usr/bin/setfile`, `/usr/local/bin/tag`, `/usr/bin/xattr`, `/usr/bin/osascript` where feasible

Detection methods
- monitor for unexpected invocation of macOS metadata utilities from ExifTool.
- alert on suspicious metadata values containing shell metacharacters.
- inspect logs for anomalous process execution after image uploads.
- use endpoint monitoring to detect creation of unexpected files or commands executed by ExifTool.

Best practices to prevent similar issues
- never construct shell commands by concatenating untrusted input
- use argument-array forms for process execution APIs
- validate and sanitize metadata values before use
- apply the principle of least privilege to file-processing services
- maintain an up-to-date vulnerability patching process
- review code for command execution patterns when handling external data

CVE CVE-2026-3102

PRODUCT exiftool-rce-2026

AFFECTED ≤ 13.49

FIXED IN 13.50

STATUS Generated

Security writeup · CVE-2026-3102

Source files · 1

lib/Image/ExifTool/MacOS.pm Linked

↗ NVD