Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle. GD::Image::_make_filehandle opens a filename argument with Perl's 2-arg open(), so a filename that begins or ends with a pipe ("| cmd", "cmd |") or begins with a redirect ("> path", ">> path") is run as a command or redirect rather than opened as a file. _make_filehandle is the single open path behind every filename-accepting constructor (new, newFromPng, newFromJpeg, and the rest); the in-memory *Data variants do not open a path and are unaffected. Any caller that forwards untrusted input to one of these constructors as a pathname can run an arbitrary command or truncate a file under the process UID.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-14 | 2 | Disclosure2 |
| 2026-06-16 | 1 | Patch1 |
| 2026-06-17 | 1 | Patch1 |
| 2026-06-18 | 1 | Disclosure1 |
⚠️ CVE-2026-11526: falha crítica no libgd-perl permite execução de comandos no #Debian. Versão corrigida: 2.78-1+deb13u1. Saiba mais: -> http://tinyurl.com/ja7274nf https://t.co/prwUMg7OrE
Post summary
The tweet alerts to a critical command-execution vulnerability in libgd-perl on Debian, cites the patched version 2.78-1+deb13u1, and offers a link for more details, but contains no PoC or exploit evidence.
Perl CPAN CVE-2026-11526: GD before 2.86 allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle https://www.openwall.com/lists/oss-security/2026/06/14/4 CVE-2026-11527: Config::IniFiles before 3.001000 - ditto https://www.openwall.com/lists/oss-security/2026/06/14/5
Post summary
The post discloses new CVEs affecting Perl CPAN modules GD and Config::IniFiles with OS command injection and file overwrite vulnerabilities, providing technical details but lacking PoC, exploits, or patch information.
🐚 OS command injection in Perl's GD library (CVE-2026-11526, CVSS 9.8). A 2-arg open() in _make_filehandle lets attackers inject shell commands via filenames. Upgrade to GD 2.86 now. https://secalerts.co/vulnerability/CVE-2026-11526 https://t.co/7hBAmysEzY
Post summary
A critical command injection vulnerability in Perl's GD library (CVE‑2026‑11526) allows OS command execution; users should upgrade to GD 2.86 to mitigate the risk.
CVE-2026-11526 GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle. GD::Image::_make_filehan… https://www.cve.org/CVERecord?id=CVE-2026-11526
Post summary
The post announces CVE-2026-11526 affecting GD versions < 2.86 for Perl, exposing OS command injection and file overwrite via a two‑argument open() call. No PoC, exploit, or patch information is included.
CVE-2026-11526 OS Command Injection and File Overwrite in GD Perl Versions Befor... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-11526 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The post announces CVE-2026-11526, outlining an OS command injection and file overwrite flaw in GD Perl versions, but offers no proof‑of‑concept, exploit code, active exploitation evidence, or patch information.