High severity7.7OSV Advisory· Published Jan 8, 2026· Updated Jun 17, 2026

CVE-2026-22035

Description

Greenshot is an open source Windows screenshot utility. Versions 1.3.310 and below arvulnerable to OS Command Injection through unsanitized filename processing. The FormatArguments method in ExternalCommandDestination.cs:269 uses string.Format() to insert user-controlled filenames directly into shell commands without sanitization, allowing attackers to execute arbitrary commands by crafting malicious filenames containing shell metacharacters. This issue is fixed in version 1.3.311.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Greenshot/GreenshotOSV2 versions
Greenshot-RELEASE-1.2.8.12, Greenshot-RELEASE-1.2.8.14, bug/546-admin-install, …+ 1 more
- (no CPE)range: Greenshot-RELEASE-1.2.8.12, Greenshot-RELEASE-1.2.8.14, bug/546-admin-install, …
- (no CPE)range: <=1.3.310
Getgreenshot/Greenshot
cpe:2.3:a:getgreenshot:greenshot:*:*:*:*:*:*:*:*
Range: <1.3.311

Patches

Vulnerability mechanics

References

github.com/greenshot/greenshot/commit/5dedd5c9f0a9896fa0af1d4980d875a48bf432cbnvdPatch
github.com/greenshot/greenshot/security/advisories/GHSA-7hvw-q8q5-gpmjnvdExploitVendor Advisory
github.com/greenshot/greenshot/releases/tag/v1.3.311nvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.501
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000