CVE-2026-61858CWE-59

ImageMagick before 7.1.2-26 Policy Bypass via APNG encoder

Medium · published July 11, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
15.0
In the wild
Unconfirmed
What it is

ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by bypassing configured policy restrictions through the APNG encoding process.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00246 · 15.0th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2026-07-11T13:01Z
EPSS history
Timeline
  • 11 JUL 13:01Z
    ImageMagick before 7.1.2-26 Policy Bypass via APNG encoder
    cvelistv5