---
id: "CVE-2026-112301"
kind: "vulnerability"
aliases: ["CVE-2026-112301"]
title: "imagemagick-php: font file argument lets remote attackers inject OS commands"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "orbitale/imagemagick-php", "fixed": [], "affected": ">= 3.3.0, <= 3.3.5", "ecosystem": "composer"}]
ecosystems: []
tags: ["command-injection", "composer", "image-processing", "imagemagick", "no-patch", "orbitale", "package", "php", "rce"]
not_affected_if: ["fixed-font-paths-only", "library-not-used", "no-user-input-in-fontfile"]
published_at: "2026-10-19T21:17:06+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-25T03:39:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112301", "first_seen_at": "2026-10-23T21:57:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:39:21+00:00"}]
---

# imagemagick-php: font file argument lets remote attackers inject OS commands

orbitale/imagemagick-php 3.3.0 to 3.3.5: Command::font() puts fontFile into a shell command line unescaped when checkFontFileExists is false (the default). run() executes it through Symfony Process::fromShellCommandline, so shell metacharacters run arbitrary commands as the PHP process user. A public PoC exists. There is no patched release and the maintainer has not responded.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:orbitale/imagemagick-php affected >= 3.3.0, <= 3.3.5 fixed ?

## How to check

- composer show orbitale/imagemagick-php (affected: 3.3.0-3.3.5, i.e. every release in that range)
- grep -rn "->font(" src/ app/ to find calls, then trace whether the argument can come from request data (user-selected font, caption or watermark features)
- Check vendor/orbitale/imagemagick-php/src/Command.php: font() appending $fontFile without escapeshellarg() means it is unpatched

## Fix

No patched version exists (latest release v3.3.5 is affected). Workaround: never pass user input to font(); allowlist font names or map them to fixed server-side paths; call font($path, true) only with an already validated path; or wrap the value in escapeshellarg() before calling. Consider replacing the library, or pinning a fork that applies escapeshellarg() to fontFile.

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112301
- 2026-10-25T03:39:21+00:00 analyst — No fixed version: GHSA/NVD/VulDB list none, releases page ends at v3.3.5, vendor silent. Root cause and public PoC read in reporter's gist (font() skips escapeshellarg unless checkFontFileExists=true; run() uses Process::fromShellCommandline). Exploitation in the wild not confirmed. Only 4 X posts in 7 days, none saved. Nothing verified: no vendor or maintainer text.

## Documents

- [advisory] GitHub Advisory Database GHSA-v63h-p5cc-2gj9 (CVE-2026-112301) https://github.com/advisories/ghsa-v63h-p5cc-2gj9
- [describes] Orbitale/ImageMagickPHP releases (latest v3.3.5) https://github.com/Orbitale/ImageMagickPHP/releases
- [describes] VulDB VDB-422347 https://vuldb.com/vuln/422347
- [poc] PoC: OS command injection in orbitale/imagemagick-php Command::font() (0xSebin) https://gist.github.com/0xSebin/834b7ab2e72d68be51d204193f427a20

## From the sources

A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. The manipulation of the argument fontFile results in os command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_