Executive brief
files.photo.gallery is a PHP-based file gallery and file manager application that allows users to browse, preview, and manage files through a web interface. A command injection vulnerability in its video thumbnail generation component allows remote attackers to execute arbitrary code by uploading a specially crafted video file, potentially compromising the entire server if file uploads are enabled.
Technical details
The vulnerability exists in the video thumbnail generation component (CWE-77: Improper Neutralization of Special Elements used in a Command). The vulnerable code constructs an ffmpeg command by directly concatenating user-controllable file paths without proper escaping. An attacker can upload a file with a malicious filename containing bash command substitution (e.g., $(arbitrary_command).mp4) and trigger thumbnail generation by visiting the gallery page. When ffmpeg processes the file, the injected command in the filename is executed with the web server's privileges. Exploitation requires file uploads to be enabled ('allow_upload' => true) and PHP exec() function to be available. Remote code execution with arbitrary command execution is achievable, limited mainly by filename length constraints.
Affected products
- files.photo.gallery files.photo.gallery 0.3.0 through 0.11.0
Timeline
- 2025-01-30: disclosed: Advisory published and CVE assigned
- 2025-01-30: exploited: Public exploit proof-of-concept available on GitHub