GHSA-26hp-cgjj-m2j3: 
PHP vulnerability analysis and mitigation

The vulnerability (GHSA-26hp-cgjj-m2j3) affects the ImageMagick driver in the fuel/core package, where unvalidated image filenames containing specially crafted strings could lead to OS command execution. This high-severity security issue was discovered in versions prior to 1.8.0.4 and was patched in version 1.8.0.4 (GitHub Advisory).

The vulnerability exists in the ImageMagick driver's handling of shell arguments, where filenames passed to the driver were not properly escaped before being used in system commands. This could allow malicious input to break out of the intended command context and execute arbitrary OS commands (FuelPHP Advisory).

When exploited, this vulnerability could allow attackers to execute arbitrary operating system commands through specially crafted image filenames, potentially leading to unauthorized system access or manipulation (GitHub Advisory).

The vulnerability can be triggered by passing unvalidated image filenames containing specially crafted strings to the ImageMagick driver. The attack requires the ability to control the filename of images being processed by the application (FuelPHP Advisory).

The issue was addressed in version 1.8.0.4 of fuel/core. Users should upgrade to this version or later to receive the security fix. The fix involves proper escaping of filenames passed to exec() commands, as implemented in commit 95c134e (GitHub Commit).