CVE-2026-49219
Received Received - Intake
Policy Bypass via Symlink in ImageMagick

Publication date: 2026-06-10

Last updated on: 2026-06-10

Assigner: GitHub, Inc.

Description
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, an incorrect parsing of the filename can result in a policy bypass and read files disallowed by a security policy using a symlink. This issue has been patched in versions 6.9.13-48 and 7.1.2-24.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-10
Last Modified
2026-06-10
Generated
2026-06-11
AI Q&A
2026-06-11
EPSS Evaluated
N/A
NVD
CVE-2026-49219
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
imagemagick imagemagick to 7.1.2-24 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

This vulnerability in ImageMagick allows a policy bypass via incorrect filename parsing, potentially enabling unauthorized reading of files disallowed by security policies.

Such unauthorized access to protected files could lead to exposure of sensitive or personal data, which may impact compliance with data protection regulations like GDPR or HIPAA that require strict controls on data access and confidentiality.

However, specific impacts on compliance depend on the context in which ImageMagick is used and the nature of the data processed.

Impact Analysis

The vulnerability can allow unauthorized reading of files that should be protected by security policies. This could lead to exposure of sensitive or confidential information if an attacker exploits the symlink-based policy bypass.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade ImageMagick to version 6.9.13-48 or later, or version 7.1.2-24 or later, where the issue has been patched.

Executive Summary

This vulnerability in ImageMagick involves incorrect parsing of filenames which can lead to a policy bypass. Specifically, it allows an attacker to use symbolic links (symlinks) to read files that are normally disallowed by the software's security policy.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49219. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart