CVE-2026-56377

ImageMagick - Policy Bypass via Incorrect Path Validation

CVSS 4.8 MEDIUMEPSS 0.2%CWE-22

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 4.8EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

30 Jun 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries.

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Affected products

ImageMagick · ImageMagick

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gm48-c7f2-v67p https://www.vulncheck.com/advisories/imagemagick-policy-bypass-via-incorrect-path-validation