CVE-2026-112301: orbitale imagemagick-php Command.php font os command injection
A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. The manipulation of the argument fontFile results in os command injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using packagist/orbitale/imagemagick-php through version 3.3.5 are affected when they call Command::font with a fontFile value that an attacker can influence. The attack is remotely exploitable.
What access does an attacker need?
The supplied vector indicates no privileges or user interaction are required. Exploitation depends on reaching code that passes attacker-controlled input into the fontFile argument.
Is a fixed release available?
No fixed version is identified in the available data. The vendor was contacted but did not respond, and a public exploit has been released.