CVE-2026-22035
HighSummary
Greenshot versions 1.3.310 and below are vulnerable to OS Command Injection through unsanitized filename processing. The FormatArguments method in ExternalCommandDestination.cs:269 uses string.Format() to insert user-controlled filenames directly into shell commands without sanitization, allowing attackers to execute arbitrary commands by crafting malicious filenames containing shell metacharacters. This issue is fixed in version 1.3.311.
Risk Assessment
Risk of remote code execution on the user's machine, potentially leading to full system compromise.
Recommendation
Update Greenshot to version 1.3.311 or later to fix the vulnerability.
Other vulnerabilities in Greenshot
See all- CVE-2023-34634High
Greenshot version 1.2.10 and below allows arbitrary code execution due to insecure deserialization of .NET content when a .greenshot file is opened.
- CVE-2025-59050High
Greenshot 1.3.300 and earlier deserializes attacker-controlled data received in a WM_COPYDATA message using BinaryFormatter.Deserialize without prior validation or authentication, allowing a local process at the same integrity level to trigger arbitrary code execution inside the Greenshot process. The authorization check for the channel occurs only after deserialization, so any gadget chain in the serialized payload executes regardless of channel membership. This is fixed in version 1.3.301.
Original NVD description (English source)
Greenshot is an open source Windows screenshot utility. Versions 1.3.310 and below arvulnerable to OS Command Injection through unsanitized filename processing. The FormatArguments method in ExternalCommandDestination.cs:269 uses string.Format() to insert user-controlled filenames directly into shell commands without sanitization, allowing attackers to execute arbitrary commands by crafting malicious filenames containing shell metacharacters. This issue is fixed in version 1.3.311.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS