CVE-2026-105081
3.6LowPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-59
Impact
Local attackers can bypass ImageMagick policy restrictions by pointing symlinks at restricted file paths. They require local access to create symlinks on the host filesystem.
Root cause
The IsRightsAuthorizedByName security policy check fails to properly resolve symbolic links before verifying access rights.
Affected systems
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33
CVSS v3.1 · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Fix & remediation
Upgrade ImageMagick to version 6.9.13-58, 7.1.2-33, or later. If patching immediately is not possible, restrict local users' ability to write symlinks in directories processed by ImageMagick.
$ magick -version || convert -versionAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to evade the configured policy.