CVE-2026-22035 | THREATINT

Description

Greenshot is an open source Windows screenshot utility. Versions 1.3.310 and below arvulnerable to OS Command Injection through unsanitized filename processing. The FormatArguments method in ExternalCommandDestination.cs:269 uses string.Format() to insert user-controlled filenames directly into shell commands without sanitization, allowing attackers to execute arbitrary commands by crafting malicious filenames containing shell metacharacters. This issue is fixed in version 1.3.311.

PUBLISHED Reserved 2026-01-05 | Published 2026-01-08 | Updated 2026-01-09 | Assigner GitHub_M

HIGH: 7.8CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Problem types

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

< 1.3.311

affected

References

github.com/...enshot/security/advisories/GHSA-7hvw-q8q5-gpmj exploit

github.com/...enshot/security/advisories/GHSA-7hvw-q8q5-gpmj

github.com/...ommit/5dedd5c9f0a9896fa0af1d4980d875a48bf432cb

github.com/greenshot/greenshot/releases/tag/v1.3.311

cve.org (CVE-2026-22035)

nvd.nist.gov (CVE-2026-22035)

Download JSON