Stills 25.24.2 Fixes Critical CVE-2026-110649 OS Command Injection Vulnerability

The Stills media processing tool contains a critical OS command injection vulnerability, identified as CVE-2026-110649, which allows attackers to execute arbitrary shell commands. This flaw affects versions of the software released before 25.24.2. The issue arises when the application processes media files with specifically crafted file paths, enabling remote code execution under the privileges of the Node.js process.

Root cause

The underlying weakness is classified as CWE-78, improper neutralisation of special elements used in an OS command. The Stills application fails to sanitise user-supplied input when constructing commands for external utilities. This lack of validation allows an attacker to inject operating system commands directly into the execution chain when specific media processing tools are invoked by the application.

Attack path

An attacker can exploit this flaw by supplying a media file path containing command substitution syntax, such as dollar signs with parentheses or backticks. When Stills processes this input, it passes the crafted path to underlying utilities including ffmpeg, ffprobe, gifsicle, or convert. These tools then execute the injected commands with the same privileges as the Node.js process running the Stills application, potentially compromising the host system.

Affected versions

• Stills versions prior to 25.24.2 are affected by this vulnerability.
• The vendor, Shahkashani, has released version 25.24.2 which addresses the issue.
• Users running any version before this release should update immediately.

Mitigation

• Upgrade Stills to version 25.24.2 or later to apply the vendor's fix.
• Restrict file path inputs to known safe directories and validate extensions.
• Run the Stills application with minimal system privileges to limit impact.
• Monitor logs for unexpected command executions from media processing tools.

What it means for organisations

Operations teams must verify that all instances of Stills are updated to the latest version. Security leads should assess whether the tool processes untrusted media from external suppliers or user uploads, as this increases exposure. Developers need to review their integration patterns to ensure that file paths are validated before being passed to the processor. Incident response plans should include procedures for isolating systems if command injection is detected in media processing workflows.

Background: Command injection

Command injection occurs when an application passes unsanitised user input to a system shell. The shell interprets this input as executable instructions rather than data. This allows attackers to run arbitrary commands on the host server, potentially leading to full system compromise or data exfiltration.

Read the full guide: Command Injection: How Unsanitised Input Breaks Your Shell

What to do and how to stay safe: Stills

• Audit your infrastructure to identify all installations of Stills and check their version numbers against the affected range.
• Review access controls to ensure that only authorised users can submit media files for processing through the application.
• Implement input validation at the application layer to reject file paths containing special characters like backticks or dollar signs.
• Monitor system processes for unexpected executions of ffmpeg, ffprobe, gifsicle, or convert originating from the Node.js environment.

General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-110649?

The National Vulnerability Database rates CVE-2026-110649 as Critical with a CVSS score of 9.3.

Which versions of Stills are vulnerable?

All versions of Stills prior to 25.24.2 are affected by this OS command injection vulnerability.

How can an attacker exploit this flaw?

Attackers can execute shell commands by supplying crafted media file paths containing command substitution syntax like $(...) or backticks.