CVE-2026-112301

Deferred Deferred - Pending Action

Command Injection in Imagemagick-php via fontFile Argument

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description

A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. The manipulation of the argument fontFile results in os command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-07

NVD

CVE-2026-112301

Affected Vendors & Products

Vendor	Product	Version / Range
orbitale	imagemagick-php	3.3.0
orbitale	imagemagick-php	3.3.1
orbitale	imagemagick-php	3.3.2
orbitale	imagemagick-php	3.3.3
orbitale	imagemagick-php	3.3.4
orbitale	imagemagick-php	3.3.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is an OS command injection flaw in the orbitale imagemagick-php library up to version 3.3.5. It exists in the Command::font function of src/Command.php where the fontFile argument can be manipulated to execute arbitrary operating system commands. The issue is remotely exploitable and a public exploit is available.

Detection Guidance

This vulnerability involves command injection in the orbitale imagemagick-php library through the Command::font function. To detect it, inspect systems using this library for unusual command execution patterns or unauthorized font file manipulations. Check logs for suspicious inputs in fontFile arguments.

Impact Analysis

If you use the affected orbitale imagemagick-php library, attackers could remotely execute arbitrary commands on your system by manipulating the fontFile parameter. This could lead to unauthorized access, data theft, system compromise, or further network infiltration depending on the permissions of the application.

Compliance Impact

This vulnerability allows remote command injection via the fontFile argument in the Command::font function, which could lead to unauthorized code execution on affected systems. Such a flaw may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data security) by enabling unauthorized access to sensitive data or systems.

Mitigation Strategies

Immediately update orbitale imagemagick-php to the latest version beyond 3.3.5. If no update is available, disable the fontFile parameter in Command::font function or restrict access to the application. Monitor network traffic for unusual command execution patterns.

Hi! I’m here to help you understand CVE-2026-112301. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...