https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 20:44:01 +0000 https://db.gcve.eu/vuln/cve-2026-11526 <p><strong>Affected:</strong> RURBAN GD</p> <p>GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle.</p> <p>GD::Image::_make_filehandle opens a filename argument with Perl&#39;s 2-arg open(), so a filename that begins or ends with a pipe (&#34;| cmd&#34;, &#34;cmd |&#34;) or begins with a redirect (&#34;&gt; path&#34;, &#34;&gt;&gt; path&#34;) is run as a command or redirect rather than opened as a file. _make_filehandle is the single open path behind every filename-accepting constructor (new, newFromPng, newFromJpeg, and the rest); the in-memory *Data variants do not open a path and are unaffected.</p> <p>Any caller that forwards untrusted input to one of these constructors as a pathname can run an arbitrary command or truncate a file under the process UID.</p> <p><strong>Affected:</strong> RURBAN GD</p> <p>GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle.</p> <p>GD::Image::_make_filehandle opens a filename argument with Perl&#39;s 2-arg open(), so a filename that begins or ends with a pipe (&#34;| cmd&#34;, &#34;cmd |&#34;) or begins with a redirect (&#34;&gt; path&#34;, &#34;&gt;&gt; path&#34;) is run as a command or redirect rather than opened as a file. _make_filehandle is the single open path behind every filename-accepting constructor (new, newFromPng, newFromJpeg, and the rest); the in-memory *Data variants do not open a path and are unaffected.</p> <p>Any caller that forwards untrusted input to one of these constructors as a pathname can run an arbitrary command or truncate a file under the process UID.</p> https://db.gcve.eu/vuln/cve-2026-11526