BaseFortify

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: VulnCheck

Description

ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2026-56377

EUVD

EUVD-2026-40450

Affected Vendors & Products

Vendor	Product	Version / Range
imagemagick	imagemagick	to 7.1.2-24 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability exists in ImageMagick versions before 7.1.2-24 and involves an incorrect policy check. It allows attackers to bypass path policy restrictions in sandboxed conversion services, enabling them to create or truncate files that should be disallowed by security policies. Essentially, attackers can write arbitrary files outside the intended boundaries set by the system.

Impact Analysis

The vulnerability can impact you by allowing an attacker with limited privileges to write or modify files outside of the intended secure areas. This could lead to unauthorized file creation or truncation, potentially compromising system integrity or security by altering important files or placing malicious files in sensitive locations.

Hi! I’m here to help you understand CVE-2026-56377. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70