CVE-2026-49219

Analyzed Analyzed - Analysis Complete

Policy Bypass via Symlink in ImageMagick

Publication date: 2026-06-10

Last updated on: 2026-06-11

Assigner: GitHub, Inc.

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, an incorrect parsing of the filename can result in a policy bypass and read files disallowed by a security policy using a symlink. This issue has been patched in versions 6.9.13-48 and 7.1.2-24.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-10

Last Modified

2026-06-11

Generated

2026-07-01

AI Q&A

2026-06-11

EPSS Evaluated

2026-06-30

NVD

CVE-2026-49219

Affected Vendors & Products

Vendor	Product	Version / Range
imagemagick	imagemagick	to 6.9.13-48 (exc)
imagemagick	imagemagick	From 7.0.0-0 (inc) to 7.1.2-24 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Impact Analysis

The vulnerability can allow unauthorized reading of files that should be protected by security policies. This could lead to exposure of sensitive or confidential information if an attacker exploits the symlink-based policy bypass.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade ImageMagick to version 6.9.13-48 or later, or version 7.1.2-24 or later, where the issue has been patched.

Executive Summary

This vulnerability in ImageMagick involves incorrect parsing of filenames which can lead to a policy bypass. Specifically, it allows an attacker to use symbolic links (symlinks) to read files that are normally disallowed by the software's security policy.

Detection Guidance

To detect the presence of this vulnerability on your system, first verify the installed version of ImageMagick. Versions prior to 6.9.13-48 and 7.1.2-24 are vulnerable.

Run the command to check ImageMagick version: `magick -version` or `convert -version`.

If the version is vulnerable, you can test for the policy bypass by attempting to process a symlinked file that should be restricted by your security policy. However, no specific detection commands or network signatures are provided in the available resources.

Compliance Impact

This vulnerability in ImageMagick allows a policy bypass via incorrect filename parsing, potentially enabling unauthorized reading of files disallowed by security policies.

Such unauthorized access to protected files could lead to exposure of sensitive or personal data, which may impact compliance with data protection regulations like GDPR or HIPAA that require strict controls on data access and confidentiality.

However, specific impacts on compliance depend on the context in which ImageMagick is used and the nature of the data processed.

Hi! I’m here to help you understand CVE-2026-49219. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70