Live › vulnerability › CVE-2026-112301
Go to dashboardorbitale/imagemagick-php 3.3.0 to 3.3.5: Command::font() puts fontFile into a shell command line unescaped when checkFontFileExists is false (the default). run() executes it through Symfony Process::fromShellCommandline, so shell metacharacters run arbitrary commands as the PHP process user. A public PoC exists. There is no patched release and the maintainer has not responded.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use orbitale/imagemagick-php 3.3.0 to 3.3.5 and pass a user-influenced value (a font choice for captions or watermarks, for example) to Command::font() are exposed to command execution as the PHP process user, with no authentication needed in the library itself. Look at web apps and workers that generate images on demand. Projects that do not use the library, or only pass fixed server-side font paths, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| orbitale/imagemagick-php | composer | >= 3.3.0, <= 3.3.5 | – |
v3.3.5 is affected)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. The manipulation of the argument fontFile results in os command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-112301")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.