GHSA-26hp-cgjj-m2j3
fuel/core ImageMagick driver does not escape all shell arguments.
This vulnerability may cause OS commands to be executed when you pass unvalidated image filenames containing specially crafted strings to the ImageMagick driver.
What each source reports
GitHub AdvisoriesNo score
fuel/core ImageMagick driver does not escape all shell arguments.
This vulnerability may cause OS commands to be executed when you pass unvalidated image filenames containing specially crafted strings to the ImageMagick driver.
- Record
GHSA-26hp-cgjj-m2j3- Weakness
- CWE-78
- Updated
- 2026-11-02
OSVNo score
fuel/core ImageMagick driver does not escape all shell arguments.
This vulnerability may cause OS commands to be executed when you pass unvalidated image filenames containing specially crafted strings to the ImageMagick driver.
- Record
GHSA-26hp-cgjj-m2j3- Weakness
- CWE-78
- Updated
- 2026-11-02
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-26hp-cgjj-m2j3 is a vulnerability with no CVSS score yet in fuel/core, published May 15, 2024. No source lists public exploit code. Fixed in fuel/core 1.8.0.4.