Loading vulnerability…
CVE-2026-3102 is an OS command injection vulnerability in ExifTool 13.49 and earlier on macOS. The flaw is in the SetMacOSTags function in lib/Image/ExifTool/MacOS.pm, where an attacker-controlled metadata value used for macOS file creation date handling reaches a system() invocation without proper neutralization. The vulnerable path is triggered when ExifTool processes macOS creation-date tags such as MDItemFSCreationDate / FileCreateDate and invokes /usr/bin/setfile. Direct writes to FileCreateDate are normally validated, but an attacker can place a malicious raw value in a more permissive source tag such as DateTimeOriginal and then use -tagsFromFile to copy it into FileCreateDate. Exploitation requires the -n flag so ExifTool accepts raw machine-readable values and bypasses the normal PrintConvInv date validation. A crafted metadata value containing shell metacharacters, including injected quotes, can break the constructed command string and cause arbitrary shell command execution.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Small standalone exploit repository containing two PoCs for a claimed ExifTool command-injection/RCE vulnerability on macOS (CVE-2026-3102). The repository has 5 files total: license/disclaimer material, a README with usage notes, and two executable PoCs in Python and Bash. The Python script is a minimal local proof-of-concept: it creates a dummy JPEG, injects a shell command into the DateTimeOriginal metadata using exiftool, then triggers processing with -tagsFromFile and checks for proof files/logs in /tmp. Its purpose is to demonstrate command execution rather than provide remote access. The Bash script is a more complete operational PoC: it builds a minimal PNG, injects a malicious DateTimeOriginal value containing a Python reverse shell one-liner, then triggers execution by copying DateTimeOriginal into FileCreateDate via exiftool. On success it creates /tmp/exiftool_pwned and attempts a reverse TCP shell to the configured attacker IP and port 4444. Overall, this is a real exploit repository rather than a detector or README-only project. The attack is primarily local/file-based: a user with the ability to run vulnerable ExifTool on crafted files can achieve arbitrary command execution, and in the Bash variant, outbound network connectivity enables a reverse shell.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
42 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced only as a related article title about an ExifTool vulnerability; no substantive details are provided in the main content.
A command injection vulnerability in ExifTool on macOS that allows arbitrary shell command execution via malicious image metadata processed through FileCreateDate handling.
Уязвимость инъекции команд в ExifTool на macOS, вызванная недостаточной очисткой значения даты/времени метаданных перед передачей в system(), что позволяет выполнить произвольные shell-команды при обработке специально подготовленного файла.
A command injection vulnerability in ExifTool on macOS that allows arbitrary shell command execution via crafted image metadata when using the -n / -printConv flag and copying metadata into FileCreateDate.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.