ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries.
CVSS Details
- CVSS 4.0 Base Score: 4.8 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 3.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade ImageMagick-perlUpgrade ImageMagick-c++Upgrade ImageMagickUpgrade ImageMagick-docUpgrade ImageMagick-develUpgrade ImageMagick-c++-develUpgrade ImageMagick-debuginfo | Oct 19, 2026 | Oct 19, 2026 |
| Amazon_linux_2023 | — | Upgrade ImageMagick-libsUpgrade ImageMagick-perl-debuginfoUpgrade ImageMagick-c++-debuginfoUpgrade ImageMagick-libs-debuginfoUpgrade ImageMagick-docUpgrade ImageMagickUpgrade ImageMagick-debuginfoUpgrade ImageMagick-debugsourceUpgrade ImageMagick-develUpgrade ImageMagick-c++-develUpgrade ImageMagick-c++Upgrade ImageMagick-perl | Sep 30, 2026 | Jun 30, 2026 |
| Debian | — | Upgrade imagemagick | Jul 14, 2026 | Jul 14, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Jun 30, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2026 | Jun 30, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub