CVE-2026-11526
GD for Perl before version 2.86 can run arbitrary commands or overwrite files when a filename starts or ends with a pipe or redirect. This allows attackers to execute commands or delete files with the application's privileges. The vulnerability is critical due to its ease of exploitation and high impact.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Perl GD library versions earlier than 2.86 used in applications that create images from filenames supplied by users.
Real-world impact
An attacker could run arbitrary commands or overwrite files on the server, potentially taking full control or causing data loss.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is network reachable, requires no privileges, has no user interaction, and can compromise confidentiality, integrity, and availability.
What to do about it
- 01Upgrade the Perl GD library to version 2.86 or later.
- 02Restart the application to ensure the new version is loaded.
NVD description indicates vulnerability fixed in GD 2.86 or later.
Timeline
- Jun 14, 2026 · Jun 14, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 23, 2026 · 12d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.