Skip to content
OpenAdvisories
High ALAS2023-2026-1890 1 CVE

Important: perl-GD security update (Amazon Linux 2023)

Published Jun 22, 2026 · Updated Jun 22, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-11526: command injection via 2-arg open() in _make_filehandle

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2023 perl-GD 0:2.80-1.amzn2023.0.3
Amazon Linux · 2023 perl-GD-debuginfo 0:2.80-1.amzn2023.0.3
Amazon Linux · 2023 perl-GD-debugsource 0:2.80-1.amzn2023.0.3

Vulnerabilities 1

  • Critical 9.8
    CVE-2026-11526

    GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle

    GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle. GD::Image::_make_filehandle opens a filename argument with Perl's 2-arg open(), so a filename that begins or ends with…

    RURBAN GD libgd-perl perl-gd Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-11526.html