Cinnamon : Command Injection with a wallpaper picture

[Bernd Dietzel]

LinuxMint with Cinnamon Desktop

cs_backgrounds.py , line 385 is vulnerable to shell code injections.

if commands.getoutput("file -bi \"%s\"" % filename).startswith("image/"):
                        picture_list.append({"filename": filename})

If you change a wallpaper picture name to an other name wich contains a shell command,
the command will run when you try to change the wallpapers in the settings

https://github.com/linuxmint/Cinnamon/issues/4658