CVE-2026-25965: ImageMagick Path Traversal Vulnerability

CVE-2026-25965 Overview

CVE-2026-25965 is a path traversal vulnerability in ImageMagick, a widely-used open-source software suite for editing and manipulating digital images. The vulnerability exists in ImageMagick's path security policy enforcement mechanism, which validates filenames before the filesystem resolves them. This allows attackers to bypass security policies using path traversal sequences, enabling unauthorized access to sensitive files even when policy-secure.xml is applied.

Critical Impact

This vulnerability enables Local File Inclusion (LFI) attacks, allowing unauthorized disclosure of sensitive system files such as /etc/passwd or configuration files containing credentials, even when ImageMagick's security policies are configured.

Affected Products

• ImageMagick versions prior to 7.1.2-15
• ImageMagick versions prior to 6.9.13-40
• Systems using ImageMagick for image processing with security policies enabled

Discovery Timeline

• 2026-02-24 - CVE CVE-2026-25965 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-25965

Vulnerability Analysis

This vulnerability represents a classic Time-of-Check Time-of-Use (TOCTOU) style flaw in ImageMagick's security policy implementation. The core issue lies in the order of operations: ImageMagick's security policy engine evaluates the raw, unnormalized filename string against policy rules before the operating system's filesystem layer resolves the actual path.

When a policy rule restricts access to sensitive directories like /etc/*, an attacker can craft a path traversal payload such as /var/log/../etc/passwd. The policy matcher sees /var/log/../etc/passwd and does not match it against the /etc/* rule. However, when the operating system resolves the path, the .. sequence is normalized, resulting in access to /etc/passwd.

This vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal. The network attack vector with no required privileges or user interaction makes this vulnerability particularly dangerous for web applications that process user-supplied images.

Root Cause

The root cause is the mismatch between the path security policy validation stage and the actual filesystem path resolution. ImageMagick performs policy checks on the raw input string before canonicalization, while the filesystem resolves traversal sequences like .. and symbolic links after the policy check passes. This architectural flaw allows the policy check to be bypassed since it never sees the final, resolved path.

Attack Vector

An attacker can exploit this vulnerability by supplying a crafted filename containing path traversal sequences to ImageMagick operations. This can occur in scenarios where:

1. Web applications allow user-supplied image paths or filenames
2. ImageMagick is used in backend processing pipelines
3. Image conversion services accept file path parameters

The attack does not require authentication and can be executed remotely through any application interface that passes user-controlled paths to ImageMagick. The attacker crafts a path that bypasses the policy matcher's pattern matching while resolving to a protected file on the filesystem. For example, requesting an image operation on /tmp/../../../etc/passwd would pass a policy blocking /etc/* but would ultimately read the /etc/passwd file.

For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-25965

Indicators of Compromise

• Presence of path traversal sequences (../, ..%2f, ..%252f) in ImageMagick-related logs
• Unexpected file read operations in ImageMagick process traces accessing sensitive directories
• Web application logs showing image processing requests with embedded directory traversal patterns
• System audit logs indicating ImageMagick processes accessing /etc/, /proc/, or other sensitive paths

Detection Strategies

• Monitor ImageMagick process activity for file access to sensitive directories outside expected paths
• Implement web application firewall (WAF) rules to detect and block path traversal patterns in image processing requests
• Enable file access auditing on sensitive system files to detect unauthorized reads by ImageMagick processes
• Review application logs for image processing requests containing ../ or URL-encoded traversal sequences

Monitoring Recommendations

• Configure SIEM alerts for ImageMagick processes reading files from sensitive directories like /etc/, /proc/, or /sys/
• Implement behavioral monitoring for ImageMagick to establish baseline file access patterns and alert on deviations
• Monitor network traffic for responses containing sensitive file contents indicative of successful LFI exploitation

How to Mitigate CVE-2026-25965

Immediate Actions Required

• Upgrade ImageMagick to version 7.1.2-15 or later for the 7.x branch
• Upgrade ImageMagick to version 6.9.13-40 or later for the 6.x branch
• Review and update ImageMagick security policies to include additional write restrictions as recommended by the vendor
• Audit applications using ImageMagick to identify potential exposure points

Patch Information

The ImageMagick project has released patched versions that address this path traversal vulnerability. The fixes are included in versions 7.1.2-15 and 6.9.13-40. Additionally, users should update their policy.xml configuration to include explicit restrictions on both read and write operations to prevent similar bypasses. Detailed patch information is available in the GitHub Security Advisory.

Workarounds

• Implement strict input validation to canonicalize and validate all file paths before passing them to ImageMagick
• Use chroot or container isolation to limit ImageMagick's filesystem access to specific directories
• Apply additional policy restrictions as recommended in the security advisory to block both read and write operations on sensitive paths
• Consider sandboxing ImageMagick processes using security frameworks such as AppArmor or SELinux

# Example policy.xml addition to restrict file access
# Add the following to your ImageMagick policy.xml to block sensitive paths
# <policy domain="path" rights="none" pattern="/etc/*" />
# <policy domain="path" rights="none" pattern="/proc/*" />
# <policy domain="path" rights="none" pattern="/sys/*" />