{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/imagemagick-php--3.3.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:orbitale:imagemagick-php:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-112301"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["imagemagick-php (\u003c= 3.3.5)"],"_cs_severities":["high"],"_cs_tags":["php","rce","vulnerability","web-application"],"_cs_type":"advisory","_cs_vendors":["orbitale"],"content_html":"\u003cp\u003eThe orbitale imagemagick-php library, which provides a PHP wrapper for ImageMagick, contains a critical OS command injection vulnerability identified as CVE-2026-112301. The flaw exists in the \u003ccode\u003eCommand::font\u003c/code\u003e function within \u003ccode\u003esrc/Command.php\u003c/code\u003e. An attacker can reach this vulnerable function by providing a specially crafted \u003ccode\u003efontFile\u003c/code\u003e argument, which is then concatenated into a shell command without adequate sanitization. This vulnerability allows for remote code execution (RCE) on systems where this library is utilized to process user-supplied input. Given that a public exploit exists, defenders should prioritize auditing applications that utilize this package for image processing, as the vendor has not provided a patch for this version range.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability results in full remote OS command execution with the privileges of the PHP process. This can lead to complete system compromise, data exfiltration, and lateral movement within the environment. All applications integrating versions of orbitale imagemagick-php up to 3.3.5 are currently at risk, as there is no vendor-supplied fix available to address this specific command injection vector.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePerform an inventory of all applications utilizing orbitale imagemagick-php to identify exposure.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation on all user-supplied parameters passed to image processing functions in PHP applications.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous requests containing shell metacharacters (e.g., ;, |, \u0026amp;, $, \u003ccode\u003e) directed at endpoints that interface with the \u003c/code\u003efontFile` parameter.\u003c/li\u003e\n\u003cli\u003eIf a patch remains unavailable, consider replacing the vulnerable library or implementing a wrapper that strictly sanitizes and escapes all input passed to the library’s functions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T22:24:02Z","date_published":"2026-10-19T22:24:02Z","id":"https://feed.craftedsignal.io/briefs/2026-10-imagemagick-php-rce/","summary":"The orbitale imagemagick-php library up to version 3.3.5 is vulnerable to remote OS command injection via the Command::font function in src/Command.php, allowing unauthenticated attackers to execute arbitrary commands.","title":"Remote OS Command Injection in orbitale imagemagick-php","url":"https://feed.craftedsignal.io/briefs/2026-10-imagemagick-php-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Imagemagick-Php (\u003c= 3.3.5)","version":"https://jsonfeed.org/version/1.1"}