CVE-2026-107704: image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format
The imageoptimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identifyformat that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file name, can append shell metacharacters like ';' that are executed via Ruby backticks with the Ruby process privileges.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
Applications using image_optimizer versions 1.3.0 through 1.9.0 are exposed when the identify option is enabled and an attacker can control an image path, such as through an uploaded filename.
What does an attacker need to exploit this issue?
The attacker needs to supply a crafted image path to the affected identify_format functionality. A path containing shell metacharacters, such as a semicolon, can cause appended commands to run without authentication or user interaction.
What privileges do injected commands receive?
Injected commands execute with the privileges of the Ruby process running the application. The impact therefore depends on the permissions and access available to that process.