App/HelperFunctions.pm in Shutter through 0.93.1 allows user-assisted remote attackers to execute arbitrary commands via a crafted image name that is mishandled during a “Show in Folder” action.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0854
Reference (s):
- https://bugs.launchpad.net/shutter/+bug/1495163