imagemagick-php CVE-2026-112301

Exploitation requires that an application using orbitale/imagemagick-php (≤3.3.5) passes attacker-influenced data into the fontFile argument of Command::font in src/Command.php without sanitization; the shell metacharacters in that value are then executed by the underlying OS. The primary limiting factor is that this is a library component, not a service - so exploitation depends entirely on whether the host application exposes the fontFile parameter to untrusted input and on the OS/shell context in which ImageMagick commands are run. No authentication is required by the library itself (CVSS PR:N), but no fix is available since the vendor did not respond to disclosure.

This is a textbook CVSS-looks-moderate, real-world-risk-is-context-dependent case. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with LOW impacts (VC:L/VI:L/VA:L) yields a 5.5 (Medium) score, and E:P explicitly marks a proof-of-concept exploit. However, there is a tension worth flagging: the weakness is CWE-78 OS command injection via the fontFile argument of Command::font, which - if attacker-controlled input actually reaches that argument - typically enables arbitrary command execution and therefore far higher impact than the LOW/LOW/LOW ratings VulDB assigned. The counterweight is that orbitale/imagemagick-php is a LIBRARY, not a standalone service, so the AV:N/PR:N framing assumes the consuming application exposes the fontFile parameter to untrusted input; that reachability is NOT guaranteed by the library itself. No EPSS score and no KEV listing are present in the input, so there is no signal of mass or active exploitation - a publicly available PoC exists, but publicly available exploit code is a distinct and weaker signal than confirmed in-the-wild use. Net: treat as a real but conditional issue - prioritize only where this library is deployed AND application code passes user-influenced data into Command::font.

A web application uses the orbitale/imagemagick-php library (≤3.3.5) and passes a user-supplied value (e.g. an uploaded or selected font path/name) into Command::font's fontFile argument without sanitization. An attacker submits a crafted fontFile value containing shell metacharacters, which is concatenated into the ImageMagick command line and executed by the OS. A public proof-of-concept exploit has been released (gist by 0xSebin), lowering the barrier to weaponization.