7 matches found
CVE-2026-107704
The imageoptimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizeridentifyformat that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file...
EUVD-2026-95149
The imageoptimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizeridentifyformat that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file...
CVE-2026-107704 image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format
The imageoptimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizeridentifyformat that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file...
CVE-2026-107704 image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format
The imageoptimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizeridentifyformat that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file...
CVE-2026-107704
The image_optimizer Ruby gem versions 1.3.0 through 1.9.0 contains an OS command injection vulnerability in the ImageOptimizer#identify_format function. When the identify option is enabled, an attacker who can control the image path—such as through an uploaded file name—can append shell metachara...
CVE-2026-107704 image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format
The imageoptimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizeridentifyformat that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file...
Remote Code Execution in extension "ImageOptimizer" (imageoptimizer)
The extension fails to validate arguments passed to a shell command resulting in Remote Code Execution. The issue is only exploitable, if an attacker is able to upload files directly e.g. SFTP or FTP to the filesystem...