Is CVE-2026-110650 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110650?

CVE-2026-110650 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-110650

Description

The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying shell metacharacters in file paths. Attackers who control a file name passed to generate_thumbnail, such as an uploaded file, can inject commands into os.system() calls running ffmpeg, convert or unoconv with the Python process privileges.