CVE-2026-105081: ImageMagick before 7.1.2-33 Policy Bypass via Symlink in IsRightsAuthorizedByName
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to evade the configured policy.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:7.1.2.33+dfsg1-1 - Upgrade
Upgrade
debian/imagemagickto a version that resolves this vulnerability.Fixed in 8:6.9.11.60+dfsg-1.6+deb12u15Fixed in 8:7.1.2.34+dfsg1-1 - Upgrade
Upgrade
ImageMagick 6.xto a version that resolves this vulnerability.Fixed in 6.9.13-58 - Upgrade
Upgrade
ImageMagick 7.xto a version that resolves this vulnerability.Fixed in 7.1.2-33
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using ImageMagick before 6.9.13-58 or 7.x before 7.1.2-33 are exposed if they rely on configured ImageMagick security policies to restrict access to particular paths and allow a local attacker to create symbolic links.
What does an attacker need to exploit it?
The attacker needs local access with permission to create a symbolic link. They can point that link to a path restricted by ImageMagick policy, causing the policy check to be bypassed.
Are default installations necessarily affected?
The issue concerns configured security-policy restrictions on paths. The provided information does not establish that an installation without relevant policy restrictions is affected.
What should be done if immediate upgrading is not possible?
Limit untrusted local users' ability to create symbolic links in locations processed by ImageMagick, and avoid processing attacker-controlled paths where policy restrictions are relied upon. Upgrade to ImageMagick 6.9.13-58 or later in the 6.x series, or 7.1.2-33 or later in the 7.x series.