CVE-2023-47104: Vareille Tinyfiledialogs

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

tinyfiledialogs (aka tiny file dialogs) before 3.15.0 allows shell metacharacters (such as a backquote or a dollar sign) in titles, messages, and other input data. NOTE: this issue exists because of an incomplete fix for CVE-2020-36767, which only considered single and double quote characters.

Affected products

• Vareille Tinyfiledialogs: before 3.15.0 (fixed in 3.15.0)

Published 2023-10-30. Last modified 2026-06-17.