CVE-2022-23935

HIGH

ExifTool <12.38 - Command Injection

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 6 public exploits for CVE-2022-23935. PoCs published by BKreisel, cowsecurity, dpbe32.

AI-analyzed exploit summary This repository contains a Python-based exploit for CVE-2022-23935, which targets ExifTool versions below 12.38. The exploit generates a malicious JPEG file that, when processed by ExifTool, triggers a reverse shell to a specified IP and port.

Description

lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\|$/ check, leading to command injection.

Exploits (6)

nomisec WORKING POC 11 stars
by BKreisel · poc
https://github.com/BKreisel/CVE-2022-23935

This repository contains a Python-based exploit for CVE-2022-23935, which targets ExifTool versions below 12.38. The exploit generates a malicious JPEG file that, when processed by ExifTool, triggers a reverse shell to a specified IP and port.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: ExifTool < 12.38
No auth needed
Prerequisites: Network access to the target system · ExifTool version < 12.38 installed on the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 8 stars
by cowsecurity · poc
https://github.com/cowsecurity/CVE-2022-23935

This PoC exploits CVE-2022-23935 in ExifTool 12.37 by generating a malicious image file with a crafted filename that executes a reverse shell when processed. The exploit uses base64 encoding to obfuscate the payload and establishes a listener for the reverse connection.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: ExifTool version 12.37
No auth needed
Prerequisites: Network connectivity to the target · ExifTool 12.37 installed on the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 1 stars
by dpbe32 · poc
https://github.com/dpbe32/CVE-2022-23935-PoC-Exploit

This PoC exploits CVE-2022-23935 in ExifTool 12.37 by renaming a file to execute a base64-encoded command, achieving remote code execution. The script requires root privileges to function as intended.

Classification
Working Poc 80%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: ExifTool version 12.37
No auth needed
Prerequisites: ExifTool 12.37 installed · root privileges
devstral-2 · analyzed Feb 16, 2026 Full analysis →
github WORKING POC
by cowsecurity · pythonpoc
https://github.com/cowsecurity/CVE-Exploits/tree/main/CVE-2022-23935

This repository contains a functional exploit for CVE-2022-23935, targeting ExifTool version 12.37. The exploit generates a malicious image file that, when processed by ExifTool, executes a reverse shell to the attacker's specified IP and port.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: ExifTool version 12.37
No auth needed
Prerequisites: Attacker-controlled IP and port for reverse shell · Victim must process the malicious image file with vulnerable ExifTool
devstral-2 · analyzed Apr 29, 2026 Full analysis →
nomisec WORKING POC
by antisecc · poc
https://github.com/antisecc/CVE-2022-23935

This PoC exploits CVE-2022-23935 in ExifTool by embedding a base64-encoded reverse shell payload in an image file's metadata. The exploit generates a malicious image and starts a listener to receive the shell connection.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: ExifTool versions prior to 12.38
No auth needed
Prerequisites: ExifTool installed on target system · Network connectivity to attacker's listener
devstral-2 · analyzed Feb 16, 2026 Full analysis →
inthewild WORKING POC
poc
https://github.com/0xftw/cve-2022-23935

This repository contains a functional exploit for CVE-2022-23935, targeting ExifTool version 12.37. The exploit generates a malicious image file with a crafted filename that, when processed by ExifTool, executes a reverse shell to the attacker's specified IP and port.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: ExifTool version 12.37
No auth needed
Prerequisites: Attacker-controlled IP and port for reverse shell · Victim must process the malicious image file with vulnerable ExifTool
devstral-2 · analyzed Feb 23, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://gist.github.com/ert-plus/1414276e4cb5d56dd431c2f0429e4429

Scores

CVSS v3 7.8
EPSS 0.2770
EPSS Percentile 96.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-78
Status published
Products (1)
exiftool_project/exiftool < 12.38
Published Jan 25, 2022
Tracked Since Feb 18, 2026