CVE-2026-11526

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-11526
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11526.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-11526
Downstream
Related
Published
2026-06-14T11:39:21Z
Modified
2026-10-28T02:30:49Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle
Details

GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle.

GD::Image::_make_filehandle opens a filename argument with Perl's 2-arg open(), so a filename that begins or ends with a pipe ("| cmd", "cmd |") or begins with a redirect ("> path", ">> path") is run as a command or redirect rather than opened as a file. _make_filehandle is the single open path behind every filename-accepting constructor (new, newFromPng, newFromJpeg, and the rest); the in-memory *Data variants do not open a path and are unaffected.

Any caller that forwards untrusted input to one of these constructors as a pathname can run an arbitrary command or truncate a file under the process UID.

Database specific 
{
    "cna_assigner":  "CPANSec",
    "cwe_ids":  [
        "CWE-73",
        "CWE-78"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11526.json"
}
References

Affected packages

Git / github.com/lstein/perl-gd

Affected ranges

Type
GIT
Repo
https://github.com/lstein/perl-gd
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
91116a6c3395326f277b64cbdd130281ede4b75a
Fixed
67b163713c6c78dfeb693da0978ae934e5cd8210
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.86"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "67b163713c6c78dfeb693da0978ae934e5cd8210"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

Other
release-2_48
release-2_49
release-2_51
release-2_56
release_2_49
release_2_58
release_2_59
release_2_60
release_2_61
release_2_62
release_2_63
release_2_64
release_2_65
release_2_66
release_2_67
release_2_68
release_2_69
release_2_70
release_2_71
release_2_72
release_2_73
release_2_74
release_2_75
release_2_76
release_2_77
release_2_78
release_2_79
release_2_80
release_2_81
release_2_82
release_2_83
release_2_84
release_2_85
v2.*
v2.56_01
v2.56_02
v2.56_03
v2.77
v2.83
v2.84
v2.85

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11526.json"