CVE-2026-107704
CriticalCVSS 9.8Summary
The image_optimizer Ruby gem versions 1.3.0 through 1.9.0 contain an OS command injection vulnerability in ImageOptimizer#identify_format. Attackers controlling the image path, such as an uploaded file name, can append shell metacharacters like ';' that are executed via Ruby backticks with the Ruby process privileges.
Risk Assessment
An attacker can execute arbitrary system commands on the server, potentially leading to full system compromise, data theft, or malware installation.
Recommendation
Upgrade to the latest version of the gem and avoid passing unsanitized paths to the identify_format method. Also validate and sanitize all input data.
Other vulnerabilities in image_optimizer
See all- CVE-2026-90953Medium
The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators.
- CVE-2026-5821High
The Image Optimizer plugin for WordPress versions up to 1.7.4 is vulnerable to arbitrary file deletion due to insufficient path validation in the Image_Backup::remove() function. Backup file paths stored in post meta are used directly in file deletion operations without verifying they are within the uploads directory. An authenticated attacker with Author-level access can inject arbitrary absolute file paths into the backups array via the Custom Fields interface, leading to file deletion when the attachment is deleted.
Original NVD description (English source)
The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file name, can append shell metacharacters like ';' that are executed via Ruby backticks with the Ruby process privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS