CVE-2026-56377

LowCVSS 3.3/10Last modified Oct 29, 2026

Description

ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
ImageMagick	ImageMagick	>= 7.0.0, < 7.1.2-24
ImageMagick	ImageMagick	< 6.9.13-48

References

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gm48-c7f2-v67pVendor Advisory
https://www.vulncheck.com/advisories/imagemagick-policy-bypass-via-incorrect-path-validationThird Party Advisory

Timeline

Published: Jun 30, 2026
Last modified: Oct 29, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-563788.2ImageMagick before 7.1.2-15 (and 6.x before 6.9.13-40) contains a heap out-of-bounds read in the PCD coder's DecodeImage loop. A crafted PCD CVE-2026-563798.1ImageMagick before 7.1.2-15 and 6.9.13-40 contains a command injection vulnerability in the SVG decoder that allows attackers to inject arbi CVE-2026-56385.3A vulnerability was detected in HerikLyma CPPWebFramework up to 3.1. This issue affects some unknown processing. Performing a manipulation r CVE-2026-563805.3AVideo through commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthenticated attackers to ret CVE-2026-563814.8Craft CMS from version 5.0.0-RC1 contains a stored cross-site scripting vulnerability in the User Permissions page where user group names ar CVE-2026-563827.2Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13 contain a remote code execution vulnerability in the FieldsControl CVE-2026-563834.8Craft CMS contains a stored cross-site scripting (XSS) vulnerability in the editableTable.twig component when using the 'Row Heading' column CVE-2026-563844.3Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user without permission to vi CVE-2026-563854.3Craft CMS versions >= 5.0.0-RC1, <= 5.9.13 and >= 4.0.0-RC1, <= 4.17.7 contain an authorization bypass in the assets/preview-file endpoint. CVE-2026-563867.5Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to CVE-2026-563877.5The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attac CVE-2026-563889.1The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can re