A flaw in the Command::font function of orbitale imagemagick-php allows an attacker to craft a malicious fontFile argument that is passed to the operating‑system shell without proper sanitisation. By supplying a payload that includes shell metacharacters, the attacker can execute arbitrary OS commands with the privileges of the web‑server process, thereby compromising the confidentiality, integrity, and availability of both the application and the host server. The vulnerability is a classic command‑injection scenario and is therefore a high‑impact risk for any exposed instance.

All installations of orbitale imagemagick-php versions 3.3.5 and earlier are vulnerable. The issue resides in src/Command.php within the Command::font method, and the product name is orbitale imagemagick-php. Users running these versions on any platform are affected until the vendor supplies a corrected release.

With a CVSS base score of 6.9, the severity is moderate, but the risk is amplified by the publicly released exploit code and the fact that the vulnerability can be triggered remotely via a crafted HTTP request. EPSS indicates a 2% probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, yet the public availability of an exploit suggests a higher likelihood of real‑world use. Attackers can leverage the exposed endpoint to inject commands, making the attack vector clearly remote and requiring only an externally reachable URL.