Vendor
The orbitale imagemagick-php library up to version 3.3.5 is vulnerable to remote OS command injection via the Command::font function in src/Command.php, allowing unauthenticated attackers to execute arbitrary commands.