All vulnerabilities
GHSA-7q74-r26w-fwcx

ImageMagick: Path Policy TOCTOU symlink race bypass in magick script

ImageMagickLibraries & packages
Open in ThreatlineRecord JSON
CVSS
2.9Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in7.1.2-32Fixed versionGitHub
Published27 Sep 2026Updated 27 Sep 2026GitHub

What fixes it

  • 7.1.2-32ImageMagick, c/c++GitHub

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

When executing a magick script it is possible to perform a TOCTOU symlink race bypass that would result in reading a file that is not allowed according to the security policy.

Text from GitHub Advisory Database

Affected versions 1

  • ImageMagick, c/c++< 7.1.2-32GitHub