CVE-2026-112301 in imagemagick-php
Summary
by MITRE • 10/20/2026
A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. The manipulation of the argument fontFile results in os command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified within orbitale imagemagick-php versions up to 3.3.5 represents a critical server-side security failure rooted in improper neutralization of special elements used in an operating system command, commonly categorized under CWE-78 Improper Neutralization of Special Elements used in an OS Command. This flaw is specifically located within the fontFile argument handling mechanism of the Command::font function found in src/Command.php. The core technical issue arises from the application's failure to adequately sanitize or validate user-supplied input before passing it to underlying system utilities, such as ImageMagick’s convert command line interface. When a developer or end-user provides a value for the fontFile parameter that contains shell metacharacters, the PHP script constructs an OS-level command string without escaping these characters effectively. This allows an attacker to inject arbitrary commands into the execution context of the web server process.
The operational impact of this vulnerability is severe due to its potential for remote code execution. Because the flaw resides in a function likely exposed through a web application interface, it can be exploited remotely by any authenticated or unauthenticated user depending on the specific integration and access controls implemented by the hosting organization. An attacker who successfully exploits this command injection vector gains the ability to execute arbitrary operating system commands with the privileges of the web server process. This typically translates to full compromise of the underlying host machine, allowing for data exfiltration, installation of backdoors, lateral movement within the network, or disruption of service through denial-of-service attacks. The availability of public exploits significantly lowers the barrier to entry for malicious actors, increasing the likelihood of automated scanning and exploitation attempts against vulnerable instances.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, specifically T1059 which covers execution via various scripting languages including PHP in this context. The lack of vendor response despite early notification highlights the importance of proactive security monitoring for open-source dependencies where maintenance may be sporadic or abandoned. Organizations relying on orbitale imagemagick-php must treat this as a high-severity issue requiring immediate remediation. Mitigation strategies should prioritize upgrading to a patched version if one becomes available, although given the vendor's non-response, alternative solutions are likely necessary. In the interim, strict input validation and whitelisting of allowed characters for font file paths can provide some defense in depth, though this is often difficult to implement correctly without modifying source code. Additionally, running web applications with minimal system privileges using principles of least privilege can limit the blast radius if an exploitation attempt succeeds.