Index: texk/dvipdfm-x/ChangeLog
===================================================================
--- texk/dvipdfm-x/ChangeLog	(revision 78398)
+++ texk/dvipdfm-x/ChangeLog	(revision 78399)
@@ -1,3 +1,16 @@
+2026-03-17  Karl Berry  <karl@tug.org>
+
+	* configure.ac: version 20260317. Post-release patch.
+	* data/dvipdfmx.cfg (D): use --; suggestion from Max Chernoff.
+
+2026-03-17  Norbert Preining  <norbert@preining.info>
+
+	* dpxfile.c (filename_unsafe_for_command): new fn to check for
+	' or " in filenames.
+	(dpx_file_apply_filter): call it.
+	Report to tlsecurity from Dawid Kulikowski of CERN,
+        9 Mar 2026 15:28:18.
+
 2026-03-02  Karl Berry  <karl@tug.org>
 
 	* TL'26 release.
Index: texk/dvipdfm-x/configure
===================================================================
--- texk/dvipdfm-x/configure	(revision 78398)
+++ texk/dvipdfm-x/configure	(revision 78399)
@@ -8939,7 +8939,7 @@
 
 # Define the identity of the package.
  PACKAGE='dvipdfm-x--tex-live-'
- VERSION='20260113'
+ VERSION='20260317'
 
 
 printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h
Index: texk/dvipdfm-x/data/dvipdfmx.cfg
===================================================================
--- texk/dvipdfm-x/data/dvipdfmx.cfg	(revision 78398)
+++ texk/dvipdfm-x/data/dvipdfmx.cfg	(revision 78399)
@@ -147,12 +147,23 @@
 %% will also be re-encoded using Flate. To turn the conversion off,
 %% remove the options mentioned above.
 %% 
+%% The -- forces the remaining argument(s) to be considered as
+%% filenames, just in case someone manages to insert a Ghostscript option.
+%% Although it's traditional to end gs invocations with "-c quit",
+%% in this context it is not necessary, and we don't want that with the --,
+%% since we wouldn't want to randomly find input files named "-c" or
+%% "quit".
+%% 
 %% Incidentally, more than one dvipdfmx.cfg may exist.
 %% You can find the one that is active by running:
 %%   kpsewhich -progname=dvipdfmx -format=othertext dvipdfmx.cfg
+%% (add -all to see all files found)
 %% and control which one is found by setting DVIPDFMXINPUTS.
 %%
-D  "rungs -q -dSAFER -dNOPAUSE -dBATCH -dEPSCrop -sPAPERSIZE=a0 -sDEVICE=pdfwrite -dCompatibilityLevel=%v -dAutoFilterGrayImages=false -dGrayImageFilter=/FlateEncode -dAutoFilterColorImages=false -dColorImageFilter=/FlateEncode -dAutoRotatePages=/None -sOutputFile='%o' '%i' -c quit"
+%% Incidentally 2, the syntax of this value is a C string: "...".
+%% The embedded '...' quotes are interpreted by dvipdfmx, not a shell.
+%% 
+D  "rungs -q -dSAFER -dNOPAUSE -dBATCH -dEPSCrop -sPAPERSIZE=a0 -sDEVICE=pdfwrite -dCompatibilityLevel=%v -dAutoFilterGrayImages=false -dGrayImageFilter=/FlateEncode -dAutoFilterColorImages=false -dColorImageFilter=/FlateEncode -dAutoRotatePages=/None -sOutputFile='%o' -- '%i'"
 %% If you change the above rungs invocation, also change dvipdfmx-unsafe.cfg!
 
 % other random ps converters people have experimented with.
Index: texk/dvipdfm-x/dpxfile.c
===================================================================
--- texk/dvipdfm-x/dpxfile.c	(revision 78398)
+++ texk/dvipdfm-x/dpxfile.c	(revision 78399)
@@ -1,5 +1,5 @@
 /* This is dvipdfmx, an eXtended version of dvipdfm by Mark A. Wicks.
-    Copyright (C) 2002-2020 by Jin-Hwan Cho and Shunsaku Hirata,
+    Copyright (C) 2002-2026 by Jin-Hwan Cho and Shunsaku Hirata,
     the dvipdfmx project team.
     
     Copyright (C) 1998, 1999 by Mark A. Wicks <mwicks@kettering.edu>
@@ -1057,10 +1057,26 @@
   return;
 }
 
+/* Return nonzero if the filename contains characters that could break
+ * out of quoting in exec_spawn()'s command parser and allow argument
+ * injection.  exec_spawn() splits on spaces and handles '...' and "..."
+ * but has no escape mechanism for embedded quotes.
+ */
+static int
+filename_unsafe_for_command (const char *name)
+{
+  const char *p;
+  for (p = name; *p; p++) {
+    if (*p == '\'' || *p == '"')
+      return 1;
+  }
+  return 0;
+}
+
 /* dpx_file_apply_filter() is used for converting unsupported graphics
  * format to one of the formats that dvipdfmx can natively handle.
  * 'input' is the filename of the original file and 'output' is actually
- * temporal files 'generated' by the above routine.   
+ * temporal files 'generated' by the above routine.
  * This should be system dependent. (MiKTeX may want something different)
  * Please modify as appropriate (see also pdfximage.c and dvipdfmx.c).
  */
@@ -1078,6 +1094,17 @@
   else if (!input || !output)
     return -1;
 
+  if (filename_unsafe_for_command(input)) {
+    WARN("Input filename contains unsafe characters for command execution: %s",
+         input);
+    return -1;
+  }
+  if (filename_unsafe_for_command(output)) {
+   WARN("Output filename contains unsafe characters for command execution: %s",
+        output);
+    return -1;
+  }
+
   size = strlen(cmdtmpl) + strlen(input) + strlen(output) + 3;
   cmd  = NEW(size, char);
   memset(cmd, 0, size);