{"schema":"threatline.record/2","record":{"id":"GHSA-7q74-r26w-fwcx","aliases":["GHSA-7q74-r26w-fwcx"],"summary":"Path Policy TOCTOU symlink race bypass in magick script","details":"When executing a magick script it is possible to perform a TOCTOU symlink race bypass that would result in reading a file that is not allowed according to the security policy.","categories":["Libraries & packages"],"product":"ImageMagick","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7q74-r26w-fwcx","source_modified_at":"2026-09-27T15:07:45Z","fetched_at":"2026-10-23T21:10:45.942435Z","package":{"ecosystem":"c/c++","name":"ImageMagick"},"range":"< 7.1.2-32"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7q74-r26w-fwcx","source_modified_at":"2026-09-27T15:07:45Z","fetched_at":"2026-10-23T21:10:45.942435Z","package":{"ecosystem":"c/c++","name":"ImageMagick"},"version":"7.1.2-32"}],"cvss":2.9,"severity":"Low","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-09-27T15:07:45Z","modified_at":"2026-09-27T15:07:45Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7q74-r26w-fwcx","fetched_at":"2026-10-23T21:10:45.942435Z","source_modified_at":"2026-09-27T15:07:45Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-27T15:07:45Z","content_hash":"5d2d18b6289c40d298b43562eadacb6763685fc1dfd37dc1b87193a5dd7d7453"}}