CVE-2026-55628 Overview
CVE-2026-55628 is a security policy bypass vulnerability in ImageMagick. Versions prior to 7.1.2-26 fail to enforce policy checks on the -concatenate operation. The missing checks allow the operation to read from and write to file paths that the ImageMagick security policy is supposed to block.
The issue is tracked under CWE-73: External Control of File Name or Path. Exploitation requires local access and user interaction, such as processing a crafted image or command file. The maintainers addressed the flaw in version 7.1.2-26.
Critical Impact
Attackers with local access can bypass ImageMagick security policy controls to read and write files outside authorized paths through the -concatenate operation.
Affected Products
- ImageMagick versions prior to 7.1.2-26
- Applications and services embedding vulnerable ImageMagick builds
- Image processing pipelines that rely on ImageMagick policy.xml restrictions
Discovery Timeline
- 2026-07-01 - CVE-2026-55628 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-55628
Vulnerability Analysis
ImageMagick uses a policy.xml configuration to restrict which coders, resources, and paths the library may access. Administrators rely on this policy to sandbox image processing when handling untrusted input. CVE-2026-55628 breaks that trust boundary.
The -concatenate operation combines multiple input images into a single output. In vulnerable releases, this code path does not consult the security policy before opening input files or writing output files. As a result, path restrictions expressed in policy.xml do not apply. An attacker who can influence the arguments or input files passed to ImageMagick can direct reads and writes to paths that policy would otherwise disallow.
The defect is classified as [CWE-73] (External Control of File Name or Path). The advisory notes impact on integrity of policy-protected files and availability of the host, consistent with unauthorized write access to sensitive paths.
Root Cause
The root cause is a missing authorization check in the -concatenate handler. Other ImageMagick operations invoke the policy engine before performing file I/O, but this code path omits that call. The omission leaves policy-defined path restrictions unenforced for concatenation workflows.
Attack Vector
Exploitation is local and requires user interaction. A user or automated workflow must invoke ImageMagick with attacker-influenced parameters or content. Once triggered, the -concatenate operation performs unauthorized file access on behalf of the invoking process. The vulnerability does not grant remote network access or elevated privileges beyond those of the caller.
No verified proof-of-concept code has been published. See the GitHub Security Advisory GHSA-82mp-vp5c-9pf7 for maintainer detail.
Detection Methods for CVE-2026-55628
Indicators of Compromise
- ImageMagick invocations that include the -concatenate argument with file paths outside expected working directories
- Unexpected file writes performed by the ImageMagick process (magick, convert) to system directories or web roots
- Reads of sensitive files such as configuration, credential, or key material by an ImageMagick worker process
Detection Strategies
- Inventory installed ImageMagick versions and flag any release earlier than 7.1.2-26
- Enable ImageMagick logging and review command lines containing -concatenate against untrusted inputs
- Correlate process telemetry showing ImageMagick binaries opening files outside declared image directories
Monitoring Recommendations
- Alert on ImageMagick child processes writing to paths not owned by the image processing service account
- Track file access events referencing policy.xml-restricted directories initiated by magick or convert
- Baseline normal ImageMagick command arguments in build and CI pipelines to detect anomalous -concatenate usage
How to Mitigate CVE-2026-55628
Immediate Actions Required
- Upgrade ImageMagick to version 7.1.2-26 or later on all systems where the library is installed
- Audit applications that shell out to ImageMagick and validate user-controlled arguments before execution
- Restrict the operating system permissions of the account running ImageMagick to limit blast radius of any policy bypass
Patch Information
The issue is fixed in ImageMagick 7.1.2-26. Refer to the ImageMagick GitHub Security Advisory GHSA-82mp-vp5c-9pf7 for the patch commit and release details. Distribution package maintainers should track their vendor advisories for backported fixes.
Workarounds
- Disallow the -concatenate operation in wrapper code that invokes ImageMagick on untrusted input until patching is complete
- Run ImageMagick inside a sandbox, container, or chroot with read-only mounts of sensitive directories
- Use mandatory access controls such as AppArmor or SELinux to constrain ImageMagick file access paths
# Verify the installed ImageMagick version meets the fixed release
magick -version | head -n 1
# Example AppArmor-style restriction concept for the ImageMagick binary
# deny /etc/** rw,
# deny /root/** rw,
# allow /var/lib/imagemagick/work/** rw,
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
