CVE-2026-61859

Katalog CVE

CVSS 3.3 · Low EPSS 0,17%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada imagemagick. Skor CVSS 3.1 3.3 (Low) menurut vulncheck.com.

Deskripsi (NVD)

ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing security policy checks. This allows reading files from paths that are otherwise disallowed by the configured security policy.

Rincian

Terbit di NVD

15 Juli 2026

Terakhir diubah

9 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

3.3 (Low), sumber vulncheck.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')

EPSS (30 hari)

0,17% peluang dieksploitasi; lebih tinggi dari 5,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vghg-5jrg-2398 advisory vendor
• https://www.vulncheck.com/advisories/imagemagick-before-26-policy-bypass-via-script-operation advisory pihak ketiga