CVE-2026-107704

The imageoptimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizeridentifyformat that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file...

CVE-2026-107704

The imageoptimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizeridentifyformat that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file...

CVE-2026-107704 image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format

The imageoptimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizeridentifyformat that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file...

CVE-2026-107704 image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format

The imageoptimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizeridentifyformat that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file...

CVE-2026-107704 image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format

The imageoptimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizeridentifyformat that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file...

EUVD-2026-95149

The imageoptimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizeridentifyformat that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file...

CVE-2026-107704

The image_optimizer Ruby gem versions 1.3.0 through 1.9.0 contains an OS command injection vulnerability in the ImageOptimizer#identify_format function. When the identify option is enabled, an attacker who can control the image path—such as through an uploaded file name—can append shell metachara...

CVE-2026-107704: Improper Neutralization of Special Elements used in an OS Command

The imageoptimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizeridentifyformat that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file...

PT-2026-108156

Name of the Vulnerable Software and Affected Versions image optimizer Ruby gem versions 1.3.0 through 1.9.0 Description An OS command injection flaw exists in the identify format function. This occurs when the identify option is enabled, allowing attackers to execute arbitrary commands by providi...

Remote Code Execution in extension "ImageOptimizer" (imageoptimizer)

The extension fails to validate arguments passed to a shell command resulting in Remote Code Execution. The issue is only exploitable, if an attacker is able to upload files directly e.g. SFTP or FTP to the filesystem...