Skip to main content

ImageMagick CVE-2026-55628

| EUVDEUVD-2026-41112 MEDIUM
External Control of File Name or Path (CWE-73)
2026-07-01 GitHub_M GHSA-82mp-vp5c-9pf7
Information Disclosure Imagemagick
5.5
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vuln.today AI
4.4 MEDIUM

Local invocation bypasses path policy, enabling read (C:L) and write (I:L) to restricted paths; no availability impact described; PR:N as any local user can invoke ImageMagick.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
4.0 AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
6.1 MEDIUM
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch available
Jul 01, 2026 - 20:02 EUVD
Analysis Generated
Jul 01, 2026 - 18:52 vuln.today

DescriptionCVE.org

In versions prior to 7.1.2-26he, the -concatenate operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. This issue has been fixed in version 7.1.2-26.

AnalysisAI

Policy bypass in ImageMagick's -concatenate operation allows local users to read from and write to filesystem paths that the configured security policy explicitly prohibits. All versions prior to 7.1.2-26 are affected. An attacker or unprivileged local user can invoke ImageMagick with -concatenate to circumvent path-based access controls defined in ImageMagick's policy.xml, effectively nullifying a primary hardening control relied upon in restricted or multi-tenant deployments. No public exploit code or CISA KEV listing is identified at time of analysis.

Technical ContextAI

ImageMagick (CPE: cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*) implements a security policy framework via policy.xml, which administrators use to restrict which filesystem paths, coders, and operations the tool may access. CWE-73 (External Control of File Name or Path) describes the root cause class: the -concatenate operation accepts user-supplied path arguments but fails to route them through the policy enforcement layer that gates all other operations. This is an incomplete implementation of the policy guard - a design gap rather than a memory-safety flaw. The result is that the <policy> domain="path" restrictions in policy.xml are not consulted when -concatenate resolves its input and output targets, allowing traversal into policy-disallowed directories.

RemediationAI

Upgrade ImageMagick to version 7.1.2-26 or later, which introduces the missing policy checks for the -concatenate operation. The vendor advisory is at https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-82mp-vp5c-9pf7. If an immediate upgrade is not possible, a targeted workaround is to add an explicit <policy domain="coder" rights="none" pattern="concatenate" /> entry to policy.xml, effectively disabling the -concatenate coder entirely; this prevents the bypass at the cost of losing concatenation functionality. Alternatively, restrict execution of ImageMagick to a dedicated, sandboxed service account via OS-level controls (e.g., seccomp profile, AppArmor, or a container with a read-only filesystem) so that even if policy.xml is bypassed, the OS enforces path isolation independently. Organizations should audit any deployment where policy.xml path restrictions are a relied-upon security boundary and treat the policy as untrusted until patched.

More in Imagemagick

View all
CVE-2017-15277 MEDIUM POC
6.5 Oct 12

ReadGIFImage in coders/gif.c in ImageMagick 7.0.6-1 and GraphicsMagick 1.3.26 leaves the palette uninitialized when proc
CVE-2016-5841 CRITICAL POC
9.8 Dec 13

Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of serv
CVE-2016-3717 MEDIUM POC
5.5 May 05

The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files vi
CVE-2016-5118 CRITICAL
9.8 Jun 10

The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbit
CVE-2016-5689 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2016-5690 CRITICAL POC
9.8 Dec 13

The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to

CVE-2016-5691 CRITICAL POC
9.8 Dec 13

The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact b
CVE-2017-14138 CRITICAL POC
9.8 Sep 04

ImageMagick 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in cer
CVE-2026-23876 CRITICAL POC
9.8 Jan 20

Heap buffer overflow in ImageMagick's XBM image decoder (ReadXBMImage) lets remote attackers write attacker-controlled d
CVE-2023-34152 CRITICAL POC
9.8 May 30

A vulnerability was found in ImageMagick. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable
CVE-2019-19952 CRITICAL POC
9.8 Dec 24

In ImageMagick 7.0.9-7 Q16, there is a use-after-free in the function MngInfoDiscardObject of coders/png.c, related to R
CVE-2018-14551 CRITICAL POC
9.8 Jul 23

The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses an uninitialized variable, leading to memory cor

Same weakness CWE-73 – External Control of File Name or Path

View all
CVE-2025-33053 HIGH POC
8.8
CVE-2023-4634 CRITICAL POC
9.8
CVE-2025-24054 MEDIUM POC
6.5
CVE-2025-0111 HIGH
7.1
CVE-2024-8517 CRITICAL POC
9.8
CVE-2024-55372 CRITICAL POC
9.8
CVE-2026-18048 HIGH POC
7.5
CVE-2024-55371 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP6-LTSS Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 Fixed

Share

CVE-2026-55628 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy