CVE-2026-22035
📋 TL;DR
CVE-2026-22035 is a command injection vulnerability in Greenshot screenshot utility that allows attackers to execute arbitrary operating system commands by crafting malicious filenames. This affects all Windows users running Greenshot versions 1.3.310 and below who use the external command destination feature.
💻 Affected Systems
- Greenshot
📦 What is this software?
Greenshot by Getgreenshot
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining SYSTEM privileges, installing malware, stealing credentials, and establishing persistence.
Likely Case
Local privilege escalation leading to data theft, lateral movement within the network, or ransomware deployment.
If Mitigated
Limited impact with only user-level access if proper application sandboxing and least privilege principles are implemented.
🎯 Exploit Status
Exploitation requires user to process a malicious filename, but the injection itself is straightforward once triggered.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.311
Vendor Advisory: https://github.com/greenshot/greenshot/security/advisories/GHSA-7hvw-q8q5-gpmj
Restart Required: Yes
Instructions:
1. Download Greenshot 1.3.311 or later from official GitHub releases. 2. Uninstall previous version. 3. Install new version. 4. Restart system.
🔧 Temporary Workarounds
Disable External Command Destination
windowsPrevent use of the vulnerable feature by disabling external command processing in Greenshot settings.
Application Sandboxing
windowsRun Greenshot with restricted permissions using Windows Sandbox or similar containerization.
🧯 If You Can't Patch
- Implement strict filename validation at network/file share level to block shell metacharacters.
- Run Greenshot under a limited user account with no administrative privileges.
🔍 How to Verify
Check if Vulnerable:
Check Greenshot version in Help > About. If version is 1.3.310 or lower, system is vulnerable.Check Version:
wmic product where name='Greenshot' get versionVerify Fix Applied:
After updating, verify version shows 1.3.311 or higher in Help > About.📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs showing unexpected cmd.exe or powershell.exe execution from Greenshot process
- Process creation events with unusual command-line arguments containing shell metacharacters
Network Indicators:
- Unexpected outbound connections from Greenshot process
- DNS queries to suspicious domains from system running Greenshot
SIEM Query:
Process Creation where (Image contains 'greenshot' AND CommandLine contains anycase ('&' OR '|' OR ';' OR '`' OR '$('))🔗 References
- https://github.com/greenshot/greenshot/commit/5dedd5c9f0a9896fa0af1d4980d875a48bf432cb
- https://github.com/greenshot/greenshot/releases/tag/v1.3.311
- https://github.com/greenshot/greenshot/security/advisories/GHSA-7hvw-q8q5-gpmj
- https://github.com/greenshot/greenshot/security/advisories/GHSA-7hvw-q8q5-gpmj
