CVE-2026-11526: GD for Perl RCE Vulnerability

CVE-2026-11526 Overview

CVE-2026-11526 is a command injection vulnerability in the GD module for Perl, affecting all versions before 2.86. The flaw resides in GD::Image::_make_filehandle, which uses Perl's 2-argument open() to handle filename arguments. Attackers who control filename input passed to constructors such as new, newFromPng, or newFromJpeg can execute arbitrary OS commands or truncate arbitrary files under the process UID. The weakness is classified as [CWE-73] External Control of File Name or Path.

Critical Impact
Untrusted input forwarded as a pathname to any GD filename-accepting constructor can run arbitrary shell commands or overwrite files with the privileges of the Perl process.

Affected Products

GD module for Perl, all versions before 2.86
Applications using GD::Image constructors new, newFromPng, newFromJpeg, and other filename-accepting variants
Perl web applications and image-processing pipelines that pass user-supplied paths to GD

Discovery Timeline

2026-06-14 - CVE-2026-11526 published to NVD
2026-06-14 - Public discussion on the Openwall oss-security mailing list
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-11526

Vulnerability Analysis

The GD Perl module exposes a single internal helper, _make_filehandle, that backs every filename-accepting constructor. Before version 2.86, this helper invoked Perl's 2-argument form of open(). Perl's 2-arg open() interprets shell metacharacters in the filename: a string beginning or ending with a pipe (| cmd or cmd |) is executed as a command, and a string beginning with > or >> opens the target for writing or appending. An attacker who controls the filename argument therefore gains arbitrary command execution or arbitrary file truncation on the host. In-memory *Data variants do not call _make_filehandle and are unaffected.

Root Cause

The root cause is the use of Perl's 2-argument open() on attacker-influenced filenames inside _make_filehandle in lib/GD/Image.pm. The 2-arg form parses the mode out of the filename string, conflating file paths with shell-like directives.

Attack Vector

Any Perl application that forwards untrusted input to a GD filename-accepting constructor is exploitable. A request parameter, queue message, or filename from a database supplied as GD::Image->newFromPng($user_input) triggers the flaw when $user_input starts or ends with |, >, or >>. Exploitation requires no authentication when the calling application is network-reachable, and the command runs under the Perl process UID.

text

   }
   return $fh if defined(fileno $fh);
 
-  # otherwise treat it as a file to open
+  # otherwise treat it as a file to open; 3-arg open so the filename is
+  # not interpreted as a command or redirect
   $fh = gensym;
-  if (!open($fh,$thing)) {
+  if (!open($fh,'<',$thing)) {
     die "$thing not found: $!";
     return undef;
   }

Source: GitHub Commit Patch. The fix replaces 2-arg open($fh,$thing) with the explicit 3-arg form open($fh,'<',$thing), forcing read-only file semantics and disabling pipe and redirect interpretation.

Detection Methods for CVE-2026-11526

Indicators of Compromise

Perl process spawning unexpected child processes such as sh, bash, curl, wget, or nc shortly after handling user-supplied image paths.
Web access logs containing filename parameters that begin or end with |, >, or >>, or contain URL-encoded equivalents (%7C, %3E).
Unexpected file truncation or creation in directories writable by the Perl service account.
New or modified files owned by the web server user with names matching shell command fragments.

Detection Strategies

Inventory Perl applications and identify call sites that pass external input to GD::Image->new, newFromPng, newFromJpeg, newFromGif, newFromGd, and related constructors.
Static analysis: grep source trees for newFrom* and GD::Image->new( calls and confirm the path argument is validated.
Runtime monitoring: alert on Perl interpreters that fork shells or open files with names containing pipe or redirect characters.

Monitoring Recommendations

Enable process-lineage telemetry on hosts running Perl web applications and correlate parent-child relationships between perl and shell binaries.
Forward web server, application, and host execution logs to a centralized analytics platform for cross-source correlation.
Track installed CPAN module versions across the fleet and alert when GD is below 2.86.

How to Mitigate CVE-2026-11526

Immediate Actions Required

Upgrade the GD Perl module to version 2.86 or later on every host that has it installed.
Audit application code for constructor calls that accept user-controlled filenames and add strict allow-list validation.
Where feasible, switch callers to the in-memory *Data constructors and pass image bytes rather than paths.
Run Perl services under a low-privilege UID with no shell and restricted filesystem write access.

Patch Information

The fix is shipped in GD 2.86. The upstream commit replaces the 2-argument open() in _make_filehandle with a 3-argument open($fh,'<',$thing) call and adds a regression test t/security_open.t. See the GitHub commit patch and the MetaCPAN release changes. The Openwall oss-security discussion provides additional background.

Workarounds

Reject any filename argument that begins with >, <, or | or ends with |, including decoded URL and Unicode variants, before calling GD.
Resolve user input to a canonical absolute path with Cwd::abs_path and confirm it resides inside a designated upload directory.
Prefer newFromPngData, newFromJpegData, and other in-memory constructors that bypass _make_filehandle entirely.

bash

# Upgrade GD to a fixed release via cpanm
cpanm GD@2.86

# Verify the installed version on each host
perl -MGD -e 'print $GD::VERSION, "\n"'