# CVE-2022-23935
The Exiftool software program, in versions prior to 12.38, has a security vulnerability that can be exploited through a specially crafted filename.
This vulnerability allows for command injection, where an attacker can execute arbitrary commands on the system by appending a pipe character '|' to the end of the filename, causing the file to be treated as a command to be executed rather than as a regular file.
As a result, any file on the system that has this naming convention can be potentially used to execute malicious code.
Log in to view the POC file snapshot cached by Shenlong Bot
Log in to view