Back Linuxsecurity

Mageia perl-GD Medium OS Command Injection Vuln 2026

Linuxsecurity •LinuxSecurity Advisories • August 3, 2026

Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges ×

Description: The updated package fixes a security vulnerability: GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle. (CVE-2026-11526)

- - - - - - - -

- 10/core/perl-GD-2.840.0-1.1.mga10 - 9/core/perl-GD-2.760.0-3.1.mga9

- 10/core/perl-GD-2.840.0-1.1.mga10

- 9/core/perl-GD-2.760.0-3.1.mga9

Publication date: 03 Aug 2026 URL: https: //advisories.mageia.org/MGASA-2026-0318.html Type: security CVE: CVE-2026-11526

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Mageia Security Updates Address Critical Perl Vulnerabilities Mageia has released security updates for two significant vulnerabilities affecting Perl packages. CVE-2026-8594, published on May 30, 2026, impacts Text::LineFold versions through 2019.001, allowing for output duplication based on special break characters. CVE-2026-11526, published on June 14, 2026, affects GD versions before 2.86, enabling OS command injection and file overwrite through improper handling of filename arguments. Both vulnerabilities pose risks to systems running affected versions of these Perl packages. Users are advised to update their systems promptly to mitigate potential exploits. The vulnerabilities were confirmed by Mageia's advisory updates on August 3, 2026. 2 sources 58

Extracted Entities

Mageia perl-GD Medium OS Command Injection Vuln 2026

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Domains (1)

MITRE ATT&CK (1)

Platforms (1)