CVE-2026-56377

Katalog CVE

CVSS 3.3 · Low EPSS 0,16%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada imagemagick. Skor CVSS 3.1 3.3 (Low) menurut vulncheck.com.

Deskripsi (NVD)

ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries.

Rincian

Terbit di NVD

30 Juni 2026

Terakhir diubah

2 Juli 2026

Status NVD

Analyzed

CVSS 3.1

3.3 (Low), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 5,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gm48-c7f2-v67p advisory vendor
• https://www.vulncheck.com/advisories/imagemagick-policy-bypass-via-incorrect-path-validation advisory pihak ketiga