Imagemagick Php
Monthly
OS command injection in orbitale/imagemagick-php through 3.3.5 lets unauthenticated remote attackers inject shell metacharacters through the fontFile argument of Command::font when a host application passes untrusted input to that parameter. Publicly available exploit code exists, but there is no CISA KEV confirmation and exploitation depends entirely on whether the calling application exposes fontFile and on the OS/shell context in which ImageMagick commands run. The vendor did not respond to disclosure, and no vendor-released patch was identified at time of analysis.
OS command injection in orbitale/imagemagick-php through 3.3.5 lets unauthenticated remote attackers inject shell metacharacters through the fontFile argument of Command::font when a host application passes untrusted input to that parameter. Publicly available exploit code exists, but there is no CISA KEV confirmation and exploitation depends entirely on whether the calling application exposes fontFile and on the OS/shell context in which ImageMagick commands run. The vendor did not respond to disclosure, and no vendor-released patch was identified at time of analysis.