CVE-2026-11526 Command injection in GD
Attackers can execute arbitrary OS commands or overwrite files by passing malicious filenames to Perl GD image constructors.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-11526?
CVE-2026-11526 is a critical command injection vulnerability in RURBAN GD, published on 14 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle.
GD::Image::_make_filehandle opens a filename argument with Perl's 2-arg open(), so a filename that begins or ends with a pipe ("| cmd", "cmd |") or begins with a redirect ("> path", ">> path") is run as a command or redirect rather than opened as a file. _make_filehandle is the single open path behind every filename-accepting constructor (new, newFromPng, newFromJpeg, and the rest); the in-memory *Data variants do not open a path and are unaffected.
Any caller that forwards untrusted input to one of these constructors as a pathname can run an arbitrary command or truncate a file under the process UID.
Which versions are affected by CVE-2026-11526?
Linux distribution packages (3)
perl-GD Red Hat:rhel_els:7 | All versions | 0:2.49-3.el7_9.1 |
perl-GD-debuginfo Red Hat:rhel_els:7 | All versions | 0:2.49-3.el7_9.1 |
perl-GD openSUSE:Tumbleweed | All versions | 2.860.0-1.1 |
How do I fix CVE-2026-11526?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-11526 being exploited?
There is no known exploitation of CVE-2026-11526 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-11526, BELL-CVE-2026-11526, DEBIAN-CVE-2026-11526, GHSA-hx22-9fx3-xg77, MGASA-2026-0318, OESA-2026-2789 and 4 more.