PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-11526 RURBAN CVE debrief

CVE-2026-11526 is a vulnerability in the GD Perl library that allows for OS command injection and file overwrite. The vulnerability exists in the _make_filehandle function, which uses Perl's 2-arg open() function to open a filename argument. This allows an attacker to inject arbitrary commands or overwrite files by providing a specially crafted filename. The vulnerability affects GD Perl library versions before 2.86.

Vendor
RURBAN
Product
GD
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-14
Original CVE updated
2026-06-21
Advisory published
2026-06-14
Advisory updated
2026-06-21

Who should care

Developers and administrators who use the GD Perl library in their applications should be aware of this vulnerability and take steps to mitigate it. This includes upgrading to GD version 2.86 or later, and ensuring that any user-inputted data is properly sanitized and validated.

Technical summary

The _make_filehandle function in the GD Perl library uses Perl's 2-arg open() function to open a filename argument. This allows an attacker to inject arbitrary commands or overwrite files by providing a specially crafted filename that begins or ends with a pipe (|) or begins with a redirect (>). The vulnerability affects all filename-accepting constructors, including new, newFromPng, and newFromJpeg.

Defensive priority

High

Recommended defensive actions

  • Upgrade to GD version 2.86 or later.
  • Ensure that any user-inputted data is properly sanitized and validated.
  • Use the in-memory *Data variants of the GD library, which are unaffected by this vulnerability.

Evidence notes

The vulnerability was reported by an unknown vendor and has been confirmed by the National Vulnerability Database (NVD).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-11526 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-11526

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-11526 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-11526

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://github.com/lstein/Perl-GD/commit/67b163713c6c78dfeb693da0978ae934e5cd8210.patch

    9b29abf9-4ab0-4765-b253-1875cd9b441e

  • Source reference

    Unverified legacy reference

    URL: https://metacpan.org/release/RURBAN/GD-2.86/changes

    9b29abf9-4ab0-4765-b253-1875cd9b441e

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.