Executive brief
The GD library for Perl, which is used for creating and manipulating graphic images, contains a vulnerability in how it handles file paths. If an application using this library allows users to provide a filename or path, an attacker could provide a specially crafted string to execute unauthorized system commands or overwrite files on the server. This could lead to a full system compromise or data loss depending on the permissions of the application.
Technical details
The vulnerability exists in GD::Image::_make_filehandle, which uses Perl's 2-argument open() function to process filename arguments. Because the 2-argument form of open() interprets special characters, an attacker can provide a filename starting or ending with a pipe character (e.g., "| cmd") to trigger OS command injection, or use redirection operators (e.g., "> path") to truncate or overwrite files. This component is the underlying path for all filename-accepting constructors, including new(), newFromPng(), and newFromJpeg(). The issue is resolved in version 2.86 by migrating to the 3-argument open() syntax, which treats the filename as a literal string. Exploitation requires the application to pass untrusted user input directly into a GD image constructor as a file path.
Affected products
- Perl-GD GD < 2.86
Timeline
- 2026-06-08: other: Fix developed by Paul Johnson
- 2026-06-14: disclosed: Vulnerability published and CVE assigned
- 2026-06-14: patched: Version 2.86 released on CPAN