CVE-2026-22035

High

Published: 08/01/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

Greenshot versions 1.3.310 and below are vulnerable to OS Command Injection through unsanitized filename processing. The FormatArguments method in ExternalCommandDestination.cs:269 uses string.Format() to insert user-controlled filenames directly into shell commands without sanitization, allowing attackers to execute arbitrary commands by crafting malicious filenames containing shell metacharacters. This issue is fixed in version 1.3.311.

Risk Assessment

Risk of remote code execution on the user's machine, potentially leading to full system compromise.

Recommendation

Update Greenshot to version 1.3.311 or later to fix the vulnerability.

Other vulnerabilities in Greenshot

CVE-2023-34634High
Greenshot version 1.2.10 and below allows arbitrary code execution due to insecure deserialization of .NET content when a .greenshot file is opened.

Original NVD description (English source)

Greenshot is an open source Windows screenshot utility. Versions 1.3.310 and below arvulnerable to OS Command Injection through unsanitized filename processing. The FormatArguments method in ExternalCommandDestination.cs:269 uses string.Format() to insert user-controlled filenames directly into shell commands without sanitization, allowing attackers to execute arbitrary commands by crafting malicious filenames containing shell metacharacters. This issue is fixed in version 1.3.311.