4

CVE-2026-106566

ImageMagick: Policy Bypass in delegate symlink cleanup due to missing check

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment variable, allowing a local privileged workflow to overwrite a file with random data. This issue is fixed in version 7.1.2-32.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerImageMagick
≫
Produkt ImageMagick
Version < 6.9.13-57
Status affected
Version >= 7.0.0, < 7.1.2-32
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 4 0.3 3.6
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N
CWE-61 UNIX Symbolic Link (Symlink) Following

The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

https://github.com/ImageMagick/ImageMagick/releases/tag/7.1.2-32
https://github.com/ImageMagick/ImageMagick6/releases/tag/6.9.13-57
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-54hm-vrmh-75qj
https://github.com/ImageMagick/ImageMagick/commit/48e5ce1779fc640a389f0020fd7d965d0c08236e
https://github.com/ImageMagick/ImageMagick6/commit/11d2af00a948e9ca2919d9a8684d335a48484094