← Vulnerability feed

Vulnerability record · CVE-2018-20211 · published 2 January 2019

CVE-2018-20211: Exiftool project exiftool uncontrolled search path element vulnerability

Exiftool Project · Exiftool

ExifTool 8.32 allows local users to gain privileges by creating a %TEMP%\par-%username%\cache-exiftool-8.32 folder with a victim's username, and then copying a Trojan horse ws32_32.dll file into this new folder, aka DLL Hijacking. NOTE: 8.32 is an obsolete version from 2010 (9.x was released starting in 2012, and 10.x was released starting in 2015).

7.8 CVSS 3.0 High EPSS 1.4% · top 29.0% CWE-427 · Uncontrolled search path element
7.8CVSS 3.0 base score, v2 6.8
1.4%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 4 tagged exploit
17 Jun 2026Last modified by NVD

Description

ExifTool 8.32 allows local users to gain privileges by creating a %TEMP%\par-%username%\cache-exiftool-8.32 folder with a victim's username, and then copying a Trojan horse ws32_32.dll file into this new folder, aka DLL Hijacking. NOTE: 8.32 is an obsolete version from 2010 (9.x was released starting in 2012, and 10.x was released starting in 2015).

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/150892/Exiftool-8.3.2.0-DLL-Hijacking.html ExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2018/Dec/44 ExploitMailing ListThird Party Advisory
http://packetstormsecurity.com/files/150892/Exiftool-8.3.2.0-DLL-Hijacking.html ExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2018/Dec/44 ExploitMailing ListThird Party Advisory

Track CVE-2018-20211 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2021-22204ExifTool DjVu parsing flaw allows arbitrary code executionExifTool versions 7.44 and later fail to neutralize user data in the DjVu file format, allowing code injection (CWE-94) when a crafted image is parse…KEVEPSS 100%analysed7.8CVE-2022-23935Exiftool project exiftool os command injection vulnerabilitylib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\|$/ check, leading to command injection.EPSS 7.6%2.1CVE-2026-3102Exiftool project exiftool command injection vulnerabilityA vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm…EPSS 2.8%7.8CVE-2020-3433Cisco AnyConnect Windows client DLL hijacking via IPC channelCisco AnyConnect Secure Mobility Client for Windows fails to properly validate resources loaded at run time, allowing a DLL hijacking attack through …KEVEPSS 10%analysed6.5CVE-2020-3153Cisco AnyConnect Windows Installer Path Handling Privilege EscalationThe Cisco AnyConnect Secure Mobility Client for Windows installer mishandles directory paths, letting an authenticated local user copy attacker-suppl…KEVEPSS 28%analysed

Source: NIST National Vulnerability Database (record CVE-2018-20211), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.