This has been done in the past. I remember seeing an advisory as far back as 2010, but at the moment can only find these two more recent advisories: https://w

This has been done in the past. I remember seeing an advisory as far back as 2010, but at the moment can only find these two more recent advisories: https://websec.io/2012/09/05/A-Silent-Threat-PHP-in-EXIF.html https://websec.io/2012/09/05/A-Silent-Threat-PHP-in-EXIF.htm... https://blog.sucuri.net/2013/07/malware-hidden-inside-jpg-exif-headers.html https://blog.sucuri.net/2013/07/malware-hidden-inside-jpg-ex... The way we protected ourselves against it at <earlier company> (since we allowed image uploads at a variety of locations) was to decode and recode the image before storing and strip out comments.