CVE-2026-112301

7.3High

Published 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

7.3High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-77, CWE-78

Impact

Remote attackers can execute arbitrary OS commands if the application passes untrusted input into the font configuration. A public exploit is available.

Root cause

The Command::font method in src/Command.php fails to sanitize the fontFile argument before invoking system shell commands.

Affected systems

orbitale/imagemagick-php up to 3.3.5

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Fix & remediation

No fixed version is currently available from the vendor; validate and strictly whitelist input passed to Command::font, or avoid passing user-supplied input to it.

shell

$ composer show orbitale/imagemagick-php

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. The manipulation of the argument fontFile results in os command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-112301