{"id":"CVE-2026-112301","kind":"vulnerability","aliases":["CVE-2026-112301"],"related":[],"title":"imagemagick-php: font file argument lets remote attackers inject OS commands","description":"A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. The manipulation of the argument fontFile results in os command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"orbitale/imagemagick-php 3.3.0 to 3.3.5: Command::font() puts fontFile into a shell command line unescaped when checkFontFileExists is false (the default). run() executes it through Symfony Process::fromShellCommandline, so shell metacharacters run arbitrary commands as the PHP process user. A public PoC exists. There is no patched release and the maintainer has not responded.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"orbitale/imagemagick-php","fixed":[],"affected":">= 3.3.0, <= 3.3.5","ecosystem":"composer"}],"ecosystems":[],"tags":["command-injection","composer","image-processing","imagemagick","no-patch","orbitale","package","php","rce"],"not_affected_if":["fixed-font-paths-only","library-not-used","no-user-input-in-fontfile"],"how_to_check":"- composer show orbitale/imagemagick-php (affected: 3.3.0-3.3.5, i.e. every release in that range)\n- grep -rn \"->font(\" src/ app/ to find calls, then trace whether the argument can come from request data (user-selected font, caption or watermark features)\n- Check vendor/orbitale/imagemagick-php/src/Command.php: font() appending $fontFile without escapeshellarg() means it is unpatched","fix":"No patched version exists (latest release v3.3.5 is affected). Workaround: never pass user input to font(); allowlist font names or map them to fixed server-side paths; call font($path, true) only with an already validated path; or wrap the value in escapeshellarg() before calling. Consider replacing the library, or pinning a fork that applies escapeshellarg() to fontFile.","status":"open","published_at":"2026-10-19T21:17:06+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T03:22:52+00:00","updated_at":"2026-10-25T03:39:21+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:22:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"imagemagick-php: font file argument lets remote attackers inject OS commands","impact":"high","summary":"The Command::font function in orbitale imagemagick-php up to 3.3.5 passes the fontFile argument into a shell command without proper sanitising. A remote attacker who controls that value can run arbitrary operating system commands on the host.","category":"package","nicknames":[],"who_cares":["php","composer","imagemagick","image-processing"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote attacker runs arbitrary OS commands on the server","analyst_note":"Check the NVD and GitHub advisory for the patched version and whether a fix exists; the vendor did not respond, so look for a fork or a workaround.","how_to_check":"- Run `composer show orbitale/imagemagick-php` and compare the installed version against `3.3.5`\n- Search the codebase for calls to `Command::font` or the `fontFile` option passed from user input","needs_analyst":true,"not_affected_if":["no-user-input-in-fontfile","library-not-used"],"who_is_affected":"Applications that depend on orbitale/imagemagick-php up to 3.3.5 and pass user-influenced values into the font option are exposed, since the flaw is in how fontFile reaches the shell. Projects that do not use this library, or that only pass fixed, server-controlled font paths, are less exposed. The sources do not name a fixed version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000606,"input_tokens":3338,"output_tokens":545,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD and GitHub advisory for the patched version and whether a fix exists; the vendor did not respond, so look for a fork or a workaround.","search":"'-112301':15A,18A '-2026':14A,17A '3.3.0':36B '3.3.5':38B,101C 'affect':102C 'arbitrari':66B 'argument':6A,119C 'attack':9A,127C,145C 'checkfontfileexist':50B 'command':12A,21B,39B,46B,67B,109C,124C 'command-inject':20B 'compos':23B 'contact':149C 'cve':13A,16A 'default':54B 'disclosur':153C 'discov':93C 'earli':150C 'execut':56B,130C 'exist':76B 'exploit':133C 'fals':52B 'file':5A,113C 'flaw':90C 'font':4A,40B,110C 'fontfil':42B,120C 'fromshellcommandlin':61B 'function':108C 'imag':25B 'image-process':24B 'imagemagick':2A,27B,97C 'imagemagick-php':1A,96C 'inject':10A,22B,125C 'issu':105C 'let':7A 'line':47B 'maintain':84B 'manipul':116C 'may':141C 'metacharact':64B 'no-patch':28B 'orbital':31B,95C 'orbitale/imagemagick-php':19A,35B 'os':11A,123C 'packag':32B 'patch':30B,80B 'php':3A,33B,70B,98C 'poc':75B 'process':26B,60B,71B 'public':74B,139C 'put':41B 'rce':34B 'releas':81B,136C 'remot':8A,131C 'respond':87B,157C 'result':121C 'run':55B,65B 'secur':89C 'shell':45B,63B 'src/command.php':114C 'symfoni':59B 'unescap':48B 'use':143C 'user':72B 'vendor':147C 'way':160C","nicknames":[],"mitigations":[],"who_affected":"Applications that use orbitale/imagemagick-php 3.3.0 to 3.3.5 and pass a user-influenced value (a font choice for captions or watermarks, for example) to Command::font() are exposed to command execution as the PHP process user, with no authentication needed in the library itself. Look at web apps and workers that generate images on demand. Projects that do not use the library, or only pass fixed server-side font paths, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T21:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-112301","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112301","severity":null,"published_at":"2026-10-19T21:17:06+00:00","modified_at":"2026-10-20T19:27:34+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112301:764","url":null,"severity":null,"published_at":"2026-10-25T03:39:21+00:00","modified_at":"2026-10-25T03:39:21+00:00","first_seen_at":"2026-10-25T03:39:21+00:00","fetched_at":"2026-10-25T03:39:21+00:00","note":"No fixed version: GHSA/NVD/VulDB list none, releases page ends at v3.3.5, vendor silent. Root cause and public PoC read in reporter's gist (font() skips escapeshellarg unless checkFontFileExists=true; run() uses Process::fromShellCommandline). Exploitation in the wild not confirmed. Only 4 X posts in 7 days, none saved. Nothing verified: no vendor or maintainer text."}],"documents":[{"id":3269,"url":"https://gist.github.com/0xSebin/834b7ab2e72d68be51d204193f427a20","title":"PoC: OS command injection in orbitale/imagemagick-php Command::font() (0xSebin)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":3270,"url":"https://github.com/advisories/ghsa-v63h-p5cc-2gj9","title":"GitHub Advisory Database GHSA-v63h-p5cc-2gj9 (CVE-2026-112301)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3271,"url":"https://github.com/Orbitale/ImageMagickPHP/releases","title":"Orbitale/ImageMagickPHP releases (latest v3.3.5)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":3272,"url":"https://vuldb.com/vuln/422347","title":"VulDB VDB-422347","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}