CellHubs ExifTool EUVD-2026-96030

Exploitation requires (1) a media file whose file path or name contains an embedded single quote plus shell metacharacters to be present on the device, and (2) the victim to open the app, select that media item, and invoke the CSV-export function, which passes the single-quoted-but-unescaped path to /system/bin/sh -c. Limiting factors: attack vector is LOCAL (AV:L) - the malicious file must already reside on the device; user interaction is mandatory (UI:A) - the victim must manually select the file and trigger CSV export; and resulting command execution is confined to the app's own sandbox/UID rather than system-level privileges. Affected build is 5.0.1-gms of CellHubs 'ExifTool for photo and video'.

This is a locally-exploitable OS command injection (CWE-78) in the CellHubs 'ExifTool for photo and video' Android app, version 5.0.1-gms. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H) scores 8.4, but the key mitigating signals are the LOCAL attack vector (AV:L) and REQUIRED user interaction (UI:A) - this is not a remotely-reachable, wormable flaw despite the high base score. Exploitation status: no public exploit identified at time of analysis (not listed in CISA KEV; no POC indicated in the provided references). No EPSS score was provided, so exploitation probability cannot be quantified. There is no SSVC decision data in the input. The confidentiality/integrity/availability impacts are HIGH but are bounded by the Android application sandbox - injected shell commands execute with the app's UID/permissions, not as a privileged system user. Net assessment: this is a genuine code-execution bug worth patching, but real-world priority is moderate rather than urgent, driven down by the local vector, mandatory user interaction, the narrow deployment footprint of this specific third-party app, and the absence of any confirmed exploitation or public POC. One note of caution: the input CVSS is a 4.0 vector only (no 3.1 vector) and no EPSS/KEV/POC signals were supplied, so confidence rests largely on the vendor advisory description.

An attacker crafts or renames a media file so its file path contains an embedded single quote followed by shell metacharacters, then gets it onto the victim's device (e.g., via download, messaging, or a shared folder). When the victim opens the app, selects that media item, and invokes the CSV-export feature, the unescaped single quote breaks out of the quoted path and the trailing characters are executed by /system/bin/sh -c in the app's context. No public exploit or POC is identified at time of analysis, and exploitation requires that specific user interaction.