CVE-2021-45463

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-12-23 · updated 2026-06-17

Description

load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load. NOTE: GEGL releases before 0.4.34 are used in GIMP releases before 2.10.30; however, this does not imply that GIMP builds enable the vulnerable feature.

Affected products

Fedoraproject Fedora: 34, 35
Gegl: before 0.4.34 — fixed in 0.4.34
GIMP: before 2.10.30 — fixed in 2.10.30
Red Hat Enterprise Linux: 7.0, 8.0

How to fix

Upgrade to a fixed version: Gegl 0.4.34; GIMP 2.10.30. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-45463 or the next vulnerability affects your stack