CVE-2025-67079
BaseFortify
Publication date: 2026-01-15
Last updated on: 2026-01-15
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| omnispace | agora_project | to 25.6.4 (inc) |
| imagick | imagick | From 7.0.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability (CVE-2025-67079) is a file upload vulnerability in the Omnispace Agora Project before version 25.10. Attackers can upload a specially crafted fake PDF file that exploits the Magick Scripting Language (MSL) engine of the Imagick library during thumbnail generation. Because Imagick interprets the PDF as MSL, this allows attackers to execute arbitrary PHP code on the server. The vulnerability arises from the way Imagick processes uploaded files, enabling remote code execution. [1]
How can this vulnerability impact me? :
This vulnerability can have severe impacts including remote code execution on the server hosting the Agora Project. An attacker can run arbitrary PHP code, potentially leading to full server compromise, data theft, unauthorized access, or disruption of services. Since the vulnerability allows execution without authentication, it poses a high risk to affected installations. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can involve monitoring for uploads of crafted PDF files that trigger the Imagick MSL engine. Since the vulnerability involves execution via file upload and thumbnail generation, inspecting upload directories for suspicious PDF files and checking Imagick's processing logs may help. Specific commands are not provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Mitigation requires disabling the Magick Scripting Language (MSL) in Imagick's policy.xml file by adding the line `<policy domain="coder" rights="none" pattern="MSL"/>` to prevent MSL file loading and execution. [1]