CVE-2026-22035
Greenshot Vulnerable to OS Command Injection via ExternalCommand Plugin
Vexday Risk Score
21Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 7.8EPSS 0.9%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
08 ene 2026Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
Greenshot is an open source Windows screenshot utility. Versions 1.3.310 and below arvulnerable to OS Command Injection through unsanitized filename processing. The FormatArguments method in ExternalCommandDestination.cs:269 uses string.Format() to insert user-controlled filenames directly into shell commands without sanitization, allowing attackers to execute arbitrary commands by crafting malicious filenames containing shell metacharacters. This issue is fixed in version 1.3.311.
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Productos afectados
greenshot · greenshot¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →