GitStock

imagemagick/imagemagick · Security

ImageMagick: Policy Bypass can read disallowed files via symlink

Open GitHub
GHSA ID
GHSA-xcjm-wqff-m669
CVE ID
CVE-2026-49219
Severity
medium
Published
Updated
CVSS
5.5 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v3
5.5 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

An incorrect parsing of the filename can result in a policy bypass and read files disallowed by a security policy using a symlink.

CWEs

  • CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
  • CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-863 · Incorrect Authorization

References