OS Command Injection in Perl GD _make_filehandle

CVE-2026-11526 affects the Perl GD distribution in versions before 2.86. The vulnerability is in GD::Image::_make_filehandle, which uses Perl's unsafe 2-argument open() on filename arguments. In Perl, 2-arg open() can interpret specially crafted strings as shell commands or redirections rather than literal file paths. As a result, a filename beginning with a pipe (for example, "| cmd"), ending with a pipe ("cmd |"), or beginning with a redirection operator (such as "> path" or ">> path") may be executed or treated as an output redirection. _make_filehandle is the common file-opening path used by filename-accepting GD constructors, including new, newFromPng, and newFromJpeg. Applications that pass untrusted pathname input into these constructors are therefore exposed to command injection and file overwrite/truncation. In-memory *Data variants are not affected because they do not open filesystem paths.