CVE-2026-56377 · Symaro Security Advisory

Description

ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries.

Severity (CVSS)

Base score	4.8
Severity	Medium
Version	CVSS 4.0
Vector	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Provided by	CNA

Weaknesses

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Vendor	Product	Versions
ImageMagick	ImageMagick	0 to <7.1.2-24; 7.1.2-24
ImageMagick	ImageMagick	0 to <6.9.13-48; 6.9.13-48

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gm48-c7f2-v67p (vendor-advisory)
https://www.vulncheck.com/advisories/imagemagick-policy-bypass-via-incorrect-path-validation (third-party-advisory)

Authoritative sources

This page is a snapshot. For the latest enrichment and updates, view the record on CVE.org or the NVD.

Generated from the official CVE List on 01 Jul 2026 07:05 UTC.