CVE-2026-105081 Overview
CVE-2026-105081 is a symlink-handling flaw in ImageMagick that allows local attackers to bypass configured security policy restrictions. The vulnerability affects ImageMagick versions before 6.9.13-58 and 7.x versions before 7.1.2-33. The IsRightsAuthorizedByName function fails to resolve symbolic links before enforcing path-based policy checks. An attacker who can create a symlink on the target system can point it at a policy-restricted path to evade the configured policy. The issue is classified as a link following weakness [CWE-59].
Critical Impact
Local attackers can bypass ImageMagick security policy restrictions by crafting symbolic links that point to policy-restricted paths, defeating controls administrators rely on to limit coder, path, or module access.
Affected Products
- ImageMagick 6.x before 6.9.13-58
- ImageMagick 7.x before 7.1.2-33
- Applications and services that invoke ImageMagick with user-supplied file paths
Discovery Timeline
- 2026-10-12 - CVE-2026-105081 published to the National Vulnerability Database
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-105081
Vulnerability Analysis
ImageMagick enforces access restrictions through a policy.xml configuration file. Administrators use this policy to block specific coders, modules, or filesystem paths. The IsRightsAuthorizedByName function evaluates whether a given name is permitted under the active policy. The function compares the supplied name against policy rules without first resolving symbolic links. An attacker who controls a filename or path can create a symlink whose textual name is allowed, while its target is a restricted resource. ImageMagick then follows the link during subsequent operations, operating on the restricted target despite the policy prohibition.
Root Cause
The root cause is a classic link following weakness [CWE-59]. The authorization check validates the name string rather than the canonical path of the underlying file. Because validation occurs before link resolution, a time-of-check versus time-of-use gap exists between the policy decision and the actual file access. The policy engine treats a benign-looking name as authorized even though the resolved target is restricted.
Attack Vector
Exploitation requires local access and the ability to create symbolic links in a directory ImageMagick will process. The attacker crafts a symlink with a name permitted by policy.xml that resolves to a path or coder the policy intends to block. When ImageMagick processes the symlink, the policy check passes based on the symlink name, and the operation proceeds against the restricted target. The attack is limited to confidentiality and integrity impacts on resources ImageMagick itself can reach. Refer to the GitHub Security Advisory GHSA-79p5-w6jv-r997 and the VulnCheck ImageMagick Policy Bypass Advisory for additional detail.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-105081
Indicators of Compromise
- Symbolic links in ImageMagick working directories whose targets resolve to paths listed as restricted in policy.xml.
- ImageMagick process activity accessing files or coders that policy rules were expected to block.
- Unexpected read or write activity by convert, magick, or identify processes against sensitive paths.
Detection Strategies
- Audit filesystem activity for symlink() or symlinkat() syscalls originating from accounts that submit input to ImageMagick workflows.
- Correlate ImageMagick invocations with the canonical paths of their input arguments to identify link indirection.
- Verify installed ImageMagick versions across the fleet and flag any instance below 6.9.13-58 or 7.1.2-33.
Monitoring Recommendations
- Enable Linux audit rules on upload and spool directories used by ImageMagick to log symlink creation events.
- Log all ImageMagick command executions with full argument paths and resolved targets.
- Monitor for new or modified policy.xml files that could indicate attempts to weaken controls alongside this bypass.
How to Mitigate CVE-2026-105081
Immediate Actions Required
- Upgrade ImageMagick to version 6.9.13-58 or 7.1.2-33 or later on all affected systems.
- Inventory applications and container images that bundle ImageMagick and schedule remediation.
- Restrict ImageMagick to run against directories where untrusted users cannot create symbolic links.
Patch Information
The ImageMagick maintainers resolved CVE-2026-105081 in ImageMagick 6.9.13-58 and 7.1.2-33. The fix ensures that IsRightsAuthorizedByName evaluates policy against the resolved target rather than the supplied name. See the GitHub Security Advisory GHSA-79p5-w6jv-r997 for full patch details and the VulnCheck ImageMagick Policy Bypass Advisory for additional context.
Workarounds
- Process ImageMagick input only from directories owned by a trusted account where other users cannot create symlinks.
- Run ImageMagick under a dedicated low-privilege account that lacks read access to sensitive paths referenced in policy.xml.
- Use filesystem options such as nosymfollow on mounts holding untrusted content, where supported by the operating system.
# Verify installed ImageMagick version meets the fixed release
magick -version | head -n 1
# Expected: Version: ImageMagick 7.1.2-33 or newer, or 6.9.13-58 or newer
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
