The vulnerability in RURBAN GD (CVE-2026-11526) involves improper neutralization of special elements in OS commands (CWE-78). Specifically, GD::Image::_make_filehandle uses Perl's 2-arg open() on filename arguments, enabling command injection when filenames begin or end with pipe ('|') or redirection ('>') characters. This affects all filename-accepting constructors (e.g., new, newFromPng, newFromJpeg) in GD versions before 2.86. Attackers can exploit this by passing crafted filenames to execute arbitrary commands or truncate files under the process's user ID. The in-memory *Data variants that do not open file paths are unaffected. No official patch or remediation level is provided in the available data.

Successful exploitation allows an unauthenticated attacker to execute arbitrary operating system commands or overwrite files with the privileges of the process running the GD library. This can lead to full system compromise, data loss, or service disruption. The CVSS score of 9.8 reflects the critical nature of this vulnerability with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid passing untrusted input to any GD filename-accepting constructors (new, newFromPng, newFromJpeg, etc.). Use in-memory *Data variants that do not open file paths when possible. Implement input validation or sanitization to prevent filenames beginning or ending with pipe or redirection characters. Monitor vendor channels for updates and apply official patches once released.