CVE-2026-11526

A flaw was found in perl-GD. A remote attacker could exploit this vulnerability by providing specially crafted filenames to functions that open files. This issue arises because the _make_filehandle function uses Perl's 2-argument open() with untrusted input, allowing special characters like pipes or redirects to be interpreted as commands or file operations. Successful exploitation could lead to arbitrary command execution or unauthorized file modification under the privileges of the affected process.

This Critical vulnerability in perl-GD enables arbitrary command execution or file overwrites when applications process untrusted input as filenames for image constructors. Exploitation occurs if an application passes a specially crafted filename containing pipe or redirect characters, allowing an attacker to execute commands or modify files with the privileges of the affected process. This poses a significant risk to system integrity and confidentiality in environments where perl-GD is used to handle external, unsanitized file paths.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Exploitation of CGI scripts using perl-GD is made difficult with the use of SecRuleEngine On from the mod_security RPM. See https://access.redhat.com/solutions/6961459 for details on installing mod_security on RHEL.