CVE-2026-55628CWE-73CWE-862

ImageMagick: Policy Bypass in concatenate operation due to missing checks

Medium · published July 1, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
0.7
In the wild
Unconfirmed
What it is

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-26he, the `-concatenate` operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. This issue has been fixed in version 7.1.2-26.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00098 · 0.7th percentile
Weaknesses
CWE-73 · External Control of File Name or Path; CWE-862 · Missing Authorization
Published
2026-07-01T18:16Z
EPSS history
Timeline
  • 01 JUL 18:16Z
    ImageMagick: Policy Bypass in concatenate operation due to missing checks
    cvelistv5