{"id":"GHSA-26hp-cgjj-m2j3","aliases":[],"title":"fuel/core ImageMagick driver does not escape all shell arguments.","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"This vulnerability may cause OS commands to be executed when you pass unvalidated image filenames containing specially crafted strings to the ImageMagick driver.","severity":"high","score":null,"published":"2024-05-15T21:44:46.000Z","modified":"2024-11-29T05:41:52.002Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"fuel/core","sources":[{"name":"OSV · GHSA-26hp-cgjj-m2j3","url":"https://osv.dev/vulnerability/GHSA-26hp-cgjj-m2j3"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.8.0.4"}],"type":"ECOSYSTEM"}],"versions":["1.8.0","1.8.0.1","1.8.0.2","1.8.0.3"],"fixed":["1.8.0.4"]}],"sourceAffected":[],"references":["https://github.com/fuel/core/commit/95c134e9e087f3c4523fe6cd86ed4e9e1e7af91c","https://fuelphp.com/security-advisories","https://github.com/FriendsOfPHP/security-advisories/blob/master/fuel/core/2016-06-29-1.yaml","https://github.com/fuel/core"],"sources":[{"name":"OSV","id":"GHSA-26hp-cgjj-m2j3","modified":"2024-11-29T05:41:52.002545Z","url":"https://osv.dev/vulnerability/GHSA-26hp-cgjj-m2j3"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"unavailable","checkedAt":"2026-10-28T22:00:32.546Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}