Executive Summary
A critical command injection vulnerability, identified as CVE-2026-3102, was discovered in ExifTool affecting macOS systems running version 13.49 and earlier. The flaw exists in the SetMacOSTags function, where user-controlled metadata values associated with macOS file creation dates (MDItemFSCreationDate or $FileCreateDate) are passed unsanitized to a system() sink. This allows an attacker to execute arbitrary shell commands with the privileges of the user invoking the tool.
Technically, the vulnerability is triggered when the -n (printConv) flag is used to bypass standard date-time validation, allowing raw malicious strings containing single quotes and command substitution to be stored in a source tag. When this data is copied to the macOS-specific creation date tag using the -tagsFromFile feature, the underlying shell command constructed by ExifTool is broken, leading to execution. This is a regression-style vulnerability similar to CVE-2021-22204 but targeting a different functional sink.
Successful exploitation could lead to full system compromise, the deployment of Trojans for data exfiltration, or lateral movement within a corporate network. Organizations processing large volumes of external media or utilizing automated image processing workflows on macOS are at significant risk.