Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-112301 Overview
CVE-2026-112301 is an operating system command injection vulnerability in the Orbitale ImageMagick-PHP library through version 3.3.5. The flaw resides in the Command::font function within src/Command.php. Attackers can manipulate the fontFile argument to inject arbitrary operating system commands. The weakness is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). A public exploit has been released, increasing the likelihood of opportunistic abuse. The vendor was contacted prior to disclosure but did not respond.
Critical Impact
Remote attackers can inject operating system commands through the fontFile parameter of Command::font, enabling code execution in the context of the PHP process without authentication.
Affected Products
- Orbitale ImageMagick-PHP versions up to and including 3.3.5
- PHP applications that pass user-controlled input to the Command::font method
- Downstream projects bundling the vulnerable src/Command.php component
Discovery Timeline
- 2026-10-19 - CVE-2026-112301 published to NVD
- 2026-10-20 - Last updated in NVD database
Technical Details for CVE-2026-112301
Vulnerability Analysis
The Orbitale ImageMagick-PHP library wraps the ImageMagick command-line tools to simplify image manipulation from PHP applications. The Command::font method accepts a fontFile argument intended to point at a TrueType font file passed to the underlying convert or magick binary. The library concatenates this argument into the shell invocation without sufficient neutralization of shell metacharacters.
An attacker who can influence the fontFile value can break out of the intended argument context and append arbitrary shell commands. Because the attack targets a web library and requires no authentication, exploitation can occur over the network wherever user input reaches the vulnerable method. Public exploit code is referenced in a GitHub Gist and documented in the VulDB vulnerability report.
Root Cause
The root cause is improper neutralization of special elements used in an operating system command [CWE-77]. The Command::font function builds a shell command string that includes the attacker-controlled fontFile value. Shell metacharacters such as ;, |, backticks, and $() are not escaped or validated. The resulting command is then executed by the underlying shell, allowing injected tokens to run as additional commands.
Attack Vector
Exploitation requires a network-reachable PHP application that forwards untrusted input into Command::font. An attacker supplies a crafted fontFile value, for example a string that terminates the expected path argument and appends a shell command. When the library invokes ImageMagick, the shell interprets the injected payload and executes it with the privileges of the PHP worker process. No user interaction or prior authentication is required.
No verified exploit code is reproduced here. Refer to the public proof-of-concept gist and the VulDB CVE report for technical specifics.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-112301
Indicators of Compromise
- Unexpected child processes spawned by php-fpm, apache2, or nginx workers, especially shells such as /bin/sh, /bin/bash, or utilities like curl, wget, and nc.
- Web server access logs containing shell metacharacters (;, |, `, $() in parameters that feed image-processing endpoints.
- Font file paths in request bodies or query strings that include whitespace followed by executable names.
- Outbound network connections from the web host to unknown IP addresses shortly after image upload or render requests.
Detection Strategies
- Instrument PHP applications with runtime monitoring to flag calls into Orbitale\ImageMagickPHP\Command::font where the fontFile argument contains shell metacharacters.
- Alert on convert or magick process invocations whose argument strings include command separators or subshell syntax.
- Correlate HTTP request parameters with subsequent process-creation events on the same host to identify injection chains.
Monitoring Recommendations
- Enable process-creation auditing (for example auditd execve rules on Linux) for web server service accounts.
- Forward web application and process telemetry to a central analytics platform and build detections for shell children of PHP interpreters.
- Track egress from web tiers and alert on new destinations following image-processing requests.
How to Mitigate CVE-2026-112301
Immediate Actions Required
- Inventory applications using orbitale/imagemagick-php and identify versions at or below 3.3.5.
- Remove or restrict any application paths that pass user-controlled values to Command::font.
- Enforce strict allow-list validation on fontFile inputs so that only known local font paths are accepted.
- Run PHP workers under least-privilege service accounts and apply filesystem restrictions to limit impact if commands execute.
Patch Information
At the time of publication, no fixed version from Orbitale has been documented in the referenced advisories, and the vendor did not respond to disclosure attempts according to the VulDB vulnerability report. Monitor the project's repository for an updated release and apply it when available. Until a vendor patch is published, treat Command::font as unsafe for untrusted input.
Workarounds
- Wrap calls to Command::font with input validation that rejects any value containing shell metacharacters or that is not an absolute path to a vetted font file on disk.
- Replace direct shell invocation with the PHP ImageMagick extension (Imagick) where feasible, which uses the library API rather than a shell command line.
- Deploy a web application firewall rule to block request parameters containing suspicious characters such as ;, |, `, $(, and && on image-processing endpoints.
- Apply mandatory access controls (AppArmor, SELinux) to restrict which binaries the PHP service account can execute.
# Example WAF-style ModSecurity rule to block shell metacharacters
# in parameters feeding image-processing endpoints
SecRule ARGS:fontFile "@rx [;|`$()&]" \
"id:1026112301,phase:2,deny,status:403,\
msg:'Potential CVE-2026-112301 command injection in fontFile'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
