ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing security policy checks. This allows reading files from paths that are otherwise disallowed by the configured security policy.
CVE-2026-61859
CVSS base score
3.3 (v3.1)
Severity
LOW
Attack vector
Local
Weakness
CWE-59
Last modified
October 29, 2026
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
imagemagick imagemagick
References
- github.com Vendor Advisory
- www.vulncheck.com Third Party Advisory