CVE-2026-25965 json
ImageMagick's policy bypass through path traversal allows reading restricted content despite secured policy
published 2026-02-24 8 mo ago modified 2026-07-30 3 mo ago also EUVD-2026-7438 , GHSA-8jvj-p28h-9gm7 , JLSEC-2026-952
- cvss
- 8.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 55%
- public exploits
- 0
- none known
Summary
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick’s path security policy is enforced on the raw filename string before the filesystem resolves it. As a result, a policy rule such as /etc/* can be bypassed by a path traversal. The OS resolves the traversal and opens the sensitive file, but the policy matcher only sees the unnormalized path and therefore allows the read. This enables local file disclosure (LFI) even when policy-secure.xml is applied. Actions to prevent reading from files have been taken in versions .7.1.2-15 and 6.9.13-40 But it make sure writing is also not possible the following should be added to one's policy. This will also be included in ImageMagick's more secure policies by default.
Patch / fix
- nuget Magick.NET-Q16-AnyCPU 14.10.3
- nuget Magick.NET-Q16-HDRI-AnyCPU 14.10.3
- nuget Magick.NET-Q16-HDRI-OpenMP-arm64 14.10.3
- nuget Magick.NET-Q16-HDRI-OpenMP-x64 14.10.3
- nuget Magick.NET-Q16-HDRI-arm64 14.10.3
- nuget Magick.NET-Q16-HDRI-x64 14.10.3
- nuget Magick.NET-Q16-HDRI-x86 14.10.3
- nuget Magick.NET-Q16-OpenMP-arm64 14.10.3
- nuget Magick.NET-Q16-OpenMP-x64 14.10.3
- nuget Magick.NET-Q16-OpenMP-x86 14.10.3
- nuget Magick.NET-Q16-arm64 14.10.3
- nuget Magick.NET-Q16-x64 14.10.3
- nuget Magick.NET-Q16-x86 14.10.3
- nuget Magick.NET-Q8-AnyCPU 14.10.3
- nuget Magick.NET-Q8-OpenMP-arm64 14.10.3
- nuget Magick.NET-Q8-OpenMP-x64 14.10.3
- nuget Magick.NET-Q8-arm64 14.10.3
- nuget Magick.NET-Q8-x64 14.10.3
- nuget Magick.NET-Q8-x86 14.10.3
- julia ImageMagick_jll 7.1.2023+0
- Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:6.9.10.68-13.el7_9
- imagemagick Debian 12 8:6.9.11.60+dfsg-1.6+deb12u7
- imagemagick Debian 13 8:7.1.1.43+dfsg1-1+deb13u6
- imagemagick Debian 14 8:7.1.2.15+dfsg1-1
debian advisories DEBIAN-CVE-2026-25965
- imagemagick Ubuntu 25.10 8:7.1.2.3+dfsg1-1ubuntu0.1
- imagemagick Ubuntu Pro 14.04 LTS 8:6.7.7.10-6ubuntu3.13+esm21
- imagemagick Ubuntu Pro 16.04 LTS 8:6.8.9.9-7ubuntu5.16+esm20
- imagemagick Ubuntu Pro 18.04 LTS 8:6.9.7.4+dfsg-16ubuntu6.15+esm12
- imagemagick Ubuntu Pro 20.04 LTS 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm10
- imagemagick Ubuntu Pro 22.04 LTS 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm10
- imagemagick Ubuntu Pro 24.04 LTS 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm9
ubuntu advisories UBUNTU-CVE-2026-25965
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- ImageMagick RHEL 7 ELS 6.9.10.68-13.el7_9
- ImageMagick-c++ RHEL 7 ELS 6.9.10.68-13.el7_9
- ImageMagick-perl RHEL 7 ELS 6.9.10.68-13.el7_9
red hat advisories RHSA-2026:5573
- ImageMagick SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 7.1.0.9-150400.6.68.2
- ImageMagick SLES for SAP 15 SP6, SLES 15 SP6-LTSS, openSUSE Leap 15.6 7.1.1.21-150600.3.42.2
- ImageMagick SLE Module for Development Tools 15 SP7, SLE Module for Desktop Applications 15 SP7 7.1.1.43-150700.3.37.1
suse advisories SUSE-SU-2026:0853-1SUSE-SU-2026:0852-1SUSE-SU-2026:0851-1
- ImageMagick openSUSE Leap 16.0 7.1.2.0-160000.6.1
- ImageMagick openSUSE Tumbleweed 7.1.2.15-1.1
opensuse advisories openSUSE-SU-2026:20337-1openSUSE-SU-2026:10267-1
- imagemagick Alpine 3.24, Alpine 3.23, Alpine 3.22 7.1.2.15-r0
alpine advisories ALPINE-CVE-2026-25965
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-25965 updated cvss 8.6
ImageMagick: ImageMagick: Local File Disclosure via Path Traversal
-
Red Hat Enterprise Linux 6 ImageMagick, ImageMagick-c++, ImageMagick-perlaffected: workaround, no fix planned “Out of support scope”
-
Red Hat Enterprise Linux Server (v. 7 ELS) ImageMagick 6.9.10.68-13.el7_9, ImageMagick-c++ 6.9.10.68-13.el7_9, ImageMagick-perl 6.9.10.68-13.el7_9 Red Hat Enterprise Linux Server Optional (v. 7 ELS) ImageMagick-c++ 6.9.10.68-13.el7_9fixed: vendor fix RHSA-2026:5573
-
Red Hat Enterprise Linux Server (v. 7 ELS) ImageMagick-debuginfo 6.9.10.68-13.el7_9 Red Hat Enterprise Linux Server Optional (v. 7 ELS) ImageMagick-doc 6.9.10.68-13.el7_9, ImageMagick-debuginfo 6.9.10.68-13.el7_9not affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 8 mo ago
Exploit prediction
0.75% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| CISA ADP | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| GitHub | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| nuget | Magick.NET-Q16-AnyCPU | <14.10.3 |
14.10.3 |
| nuget | Magick.NET-Q16-HDRI-AnyCPU | <14.10.3 |
14.10.3 |
| nuget | Magick.NET-Q16-HDRI-OpenMP-arm64 | <14.10.3 |
14.10.3 |
| nuget | Magick.NET-Q16-HDRI-OpenMP-x64 | <14.10.3 |
14.10.3 |
| nuget | Magick.NET-Q16-HDRI-arm64 | <14.10.3 |
14.10.3 |
| nuget | Magick.NET-Q16-HDRI-x64 | <14.10.3 |
14.10.3 |
| nuget | Magick.NET-Q16-HDRI-x86 | <14.10.3 |
14.10.3 |
| nuget | Magick.NET-Q16-OpenMP-arm64 | <14.10.3 |
14.10.3 |
| nuget | Magick.NET-Q16-OpenMP-x64 | <14.10.3 |
14.10.3 |
| nuget | Magick.NET-Q16-OpenMP-x86 | <14.10.3 |
14.10.3 |
| nuget | Magick.NET-Q16-arm64 | <14.10.3 |
14.10.3 |
| nuget | Magick.NET-Q16-x64 | <14.10.3 |
14.10.3 |
| nuget | Magick.NET-Q16-x86 | <14.10.3 |
14.10.3 |
| nuget | Magick.NET-Q8-AnyCPU | <14.10.3 |
14.10.3 |
| nuget | Magick.NET-Q8-OpenMP-arm64 | <14.10.3 |
14.10.3 |
| nuget | Magick.NET-Q8-OpenMP-x64 | <14.10.3 |
14.10.3 |
| nuget | Magick.NET-Q8-arm64 | <14.10.3 |
14.10.3 |
| nuget | Magick.NET-Q8-x64 | <14.10.3 |
14.10.3 |
| nuget | Magick.NET-Q8-x86 | <14.10.3 |
14.10.3 |
| julia | ImageMagick_jll | <7.1.2023+0 |
7.1.2023+0 |
Affected products
- ImageMagick ImageMagick
- Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
- Red Hat Red Hat Enterprise Linux 6
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
access.redhat.com
/errata/RHSA-2026:5573
vendor-advisory, web
-
github.com
/ImageMagick/ImageMagick/security/advisories/GHSA-8jvj-p28h-9gm7
web, third-party-advisory
-
access.redhat.com
/security/cve/CVE-2026-25965
vdb-entry, web
-
bugzilla.redhat.com
/show_bug.cgi?id=2442118
issue-tracking, web
-
security.access.redhat.com
/data/csaf/v2/vex/2026/cve-2026-25965.json
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-25965
advisory, web
-
github.com
/ImageMagick/ImageMagick
package
-
github.com
/dlemstra/Magick.NET/releases/tag/14.10.3
web
-
github.com
/advisories/GHSA-8jvj-p28h-9gm7
web
Sources
- CVE List CVE-2026-25965
- GitHub Advisory GHSA-8jvj-p28h-9gm7
- NVD CVE-2026-25965
- OSV JLSEC-2026-952
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.