CVE-2026-11526: GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle

Synopsis

OS command injection and file overwrite in the Perl GD image library (versions before 2.86) via a vulnerable 2-argument open() call inside the _make_filehandle function. The flaw is reachable over the network with no authentication required, affecting any application that forwards untrusted filenames to GD constructors such as new, newFromPng, or newFromJpeg. Successful exploitation lets an attacker execute arbitrary OS commands or overwrite files under the process UID, compromising confidentiality, integrity, and availability. A patched-image rebuild at version 2.86 is available on HarborGuard for environments running an affected version of the GD Perl module.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable GD constructors are typically exposed via a network-facing application, so an attacker must be able to reach the service over the network to deliver a crafted filename.

• AuthenticationNot required

  No credentials or account are needed; the attack can be carried out by an unauthenticated remote party who can supply a filename to the application.

• Victim interactionNot required

  No user action is needed; exploitation is fully attacker-driven once a crafted filename reaches a GD constructor.

• Attack complexityDetail

  Attack complexity is low: the exploit requires no race conditions, specific memory layout, or environmental preconditions beyond supplying a pipe-prefixed or pipe-suffixed filename string.

Blast Radius

• Reads arbitrary files and data accessible to the process UID, including secrets, configuration, and application data.
• Executes arbitrary OS commands under the process UID, enabling full host compromise within the container or process boundary.
• Overwrites or truncates arbitrary files writable by the process UID, destroying application state or configuration.
• Disrupts availability of the affected service by corrupting critical files or consuming resources via spawned processes.