ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries.
CVE-2026-56377
CVSS base score
3.3 (v3.1)
Severity
LOW
Attack vector
Local
Weakness
CWE-22
Last modified
October 29, 2026
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
imagemagick imagemagick
References
- github.com Vendor Advisory
- www.vulncheck.com Third Party Advisory