{"id":"CVE-2026-22035","summary":"Greenshot Vulnerable to OS Command Injection via ExternalCommand Plugin","details":"Greenshot is an open source Windows screenshot utility. Versions 1.3.310 and below arvulnerable to OS Command Injection through unsanitized filename processing. The FormatArguments method in ExternalCommandDestination.cs:269 uses string.Format() to insert user-controlled filenames directly into shell commands without sanitization, allowing attackers to execute arbitrary commands by crafting malicious filenames containing shell metacharacters. This issue is fixed in version 1.3.311.","aliases":["GHSA-7hvw-q8q5-gpmj"],"modified":"2026-08-12T03:51:42.978143850Z","published":"2026-01-08T00:10:28.278Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22035.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-78"]},"references":[{"type":"WEB","url":"https://github.com/greenshot/greenshot/releases/tag/v1.3.311"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22035.json"},{"type":"ADVISORY","url":"https://github.com/greenshot/greenshot/security/advisories/GHSA-7hvw-q8q5-gpmj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22035"},{"type":"FIX","url":"https://github.com/greenshot/greenshot/commit/5dedd5c9f0a9896fa0af1d4980d875a48bf432cb"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/greenshot/greenshot","events":[{"introduced":"0"},{"fixed":"5dedd5c9f0a9896fa0af1d4980d875a48bf432cb"}],"database_specific":{"cpe":"cpe:2.3:a:getgreenshot:greenshot:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.3.311"}],"source":["AFFECTED_FIELD","CPE_RANGE","REFERENCES"]}}],"versions":["v1.3.310","v1.3.304","v1.3.303","v1.3.302","v1.3.301","v1.3.300","v1.3.299","v1.3.298","v1.3.297","v1.3.296","bug/546-admin-install","v1.3.294","v1.3.293","v1.3.292","v1.3.291","v1.3.290","v1.3.289","v1.3.288","v1.3.287","v1.3.286","v1.3.284","v1.3.281","v1.3.277","v1.3.275","v1.3.274","v1.3.273","v1.3.270","v1.3.265","v1.3.262","v1.3.261","v1.3.260","v1.3.259","v1.3.258","v1.3.256","v1.3.254","v1.3.249","v1.3.246","v1.3.244","v1.3.239","v1.3.238","v1.3.235","v1.3.234","v1.3.231","v1.3.229","v1.3.223","v1.3.220","v1.3.219","v1.3.218","v1.3.213","v1.3.211","v1.3.205","v1.3.204","v1.3.203","v1.3.202","v1.3.201","v1.3.194","v1.3.178","v1.3.157","v1.3.154","v1.3.151","v1.3.108","v1.3.106","v1.3.105","v1.3.76","v1.3.75","v1.3.71","v1.3.69","v1.3.63","v1.3.57","v1.3.55","Greenshot-RELEASE-1.2.8.14","Greenshot-RELEASE-1.2.8.12"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22035.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H"}]}