VU#580079: Arbitrary file read/write vulnerability in ImageMagick-based applications with default configuration
Source CERT/CC
Rated High by Threat Radar's AI analysis
Data as of 12 Nov 2026, 18:21 UTC
What to do
AI-suggested
Users should install vendor-provided updates when available, such as Ruby on Rails updates shipping a restrictive policy.xml. Updating ImageMagick alone may be insufficient if security policies continue to permit dangerous coders or delegates. Apply a custom policy.xml based on an allowlist to enable only required formats and operations, disabling MSL, MVG, PS, EPS, PDF, and other dangerous coders. Isolate image processing in minimally privileged environments with restricted filesystem access. Validate and constrain input by verifying file content rather than relying on filenames or media types. Monitor ImageMagick processing for policy violations, unexpected coder or delegate use, and unexpected file creation. Consult vendor advisories for product-specific guidance.
Description
Multiple arbitrary file read and write vulnerabilities, collectively called ImageTragick2, affect applications using ImageMagick with default or insufficiently restrictive security policies. These vulnerabilities arise when ImageMagick processes crafted SVG or PostScript content, potentially allowing attackers to read or write files accessible to the ImageMagick process. In some cases, this can lead to arbitrary code execution. The vulnerabilities depend on the availability of dangerous coders or delegates and insufficiently restrictive security policies. Applications such as Ruby on Rails, WordPress, ownCloud Classic, and Redmine are impacted if they use vulnerable ImageMagick configurations. Mitigations include applying restrictive custom security policies, isolating image processing, and validating input content.