CVE-2026-61859: ImageMagick Path Traversal Vulnerability

CVE-2026-61859 Overview

CVE-2026-61859 is a security policy bypass vulnerability in ImageMagick versions prior to 7.1.2-26 and 6.9.13-x before 6.9.13-51. The flaw resides in the -script operation, which fails to enforce security policy checks before accessing files. Attackers with local access can read files from paths that the configured policy.xml would otherwise block. The vulnerability is tracked under CWE-59: Improper Link Resolution Before File Access and was published to the National Vulnerability Database (NVD) on July 15, 2026.

Critical Impact
The -script operation bypasses ImageMagick's security policy, allowing unauthorized read access to files that administrators intended to protect through path-based restrictions.

Affected Products

ImageMagick versions before 7.1.2-26
ImageMagick 6.9.13-x versions before 6.9.13-51
Applications and services embedding vulnerable ImageMagick builds

Discovery Timeline

2026-07-15 - CVE-2026-61859 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-61859

Vulnerability Analysis

ImageMagick enforces access controls through its policy.xml configuration file. Administrators use this file to restrict coders, delegates, and file paths that ImageMagick may access. The -script operation, which processes a sequence of commands from an input file, does not consult the security policy when opening referenced files. This inconsistency lets an attacker use the -script flag to read files that the policy explicitly disallows through path or pattern restrictions. The vulnerability requires local access and low privileges, and no user interaction is needed.

Root Cause

The root cause is a missing security policy check within the -script operation code path. Other ImageMagick operations validate file access against the loaded policy.xml rules before performing I/O. The -script handler proceeds directly to file open calls, which permits reads that would fail through any other operation. This inconsistency between code paths is characteristic of [CWE-59] and reflects a gap in centralized policy enforcement.

Attack Vector

An attacker with local access to a system running vulnerable ImageMagick invokes the -script operation and references a restricted file path. Because policy checks are absent, ImageMagick reads the file and can surface its contents through script processing or subsequent output operations. In multi-tenant environments or web applications that expose ImageMagick command-line functionality to users, this bypass can expose configuration files, credentials, or other sensitive data that administrators intended to isolate.

Refer to the GitHub Security Advisory GHSA-vghg-5jrg-2398 and the VulnCheck ImageMagick Advisory for the vendor's technical description of the affected code path.

Detection Methods for CVE-2026-61859

Indicators of Compromise

ImageMagick command-line invocations containing -script combined with paths outside expected working directories
Process telemetry showing magick, convert, or mogrify accessing files matching patterns restricted by policy.xml
Unexpected reads of sensitive files such as /etc/passwd, /etc/shadow, or application secrets by ImageMagick processes

Detection Strategies

Audit installed ImageMagick versions across servers and container images against the patched releases 7.1.2-26 and 6.9.13-51
Monitor process execution logs for -script arguments issued by web application service accounts or unprivileged users
Correlate ImageMagick file-open events with the paths declared as restricted in the deployed policy.xml

Monitoring Recommendations

Enable Linux auditd rules covering execve events for ImageMagick binaries and capture full command-line arguments
Forward container runtime and endpoint telemetry to a centralized data lake for retrospective search when new advisories emerge
Alert on ImageMagick child processes spawned by web servers that consume user-controlled input

How to Mitigate CVE-2026-61859

Immediate Actions Required

Upgrade ImageMagick to version 7.1.2-26 or later, or to 6.9.13-51 for the 6.x branch
Inventory all systems, containers, and application dependencies that bundle ImageMagick and prioritize patching internet-facing services
Restrict which local users and service accounts may invoke ImageMagick command-line utilities

Patch Information

The ImageMagick project has released fixed builds in versions 7.1.2-26 and 6.9.13-51. Distribution maintainers are expected to backport the fix, so administrators should also apply operating system updates for packages such as imagemagick, imagemagick-6.q16, and imagemagick-7.q16. Consult the GitHub Security Advisory GHSA-vghg-5jrg-2398 for the authoritative fix commit and release notes.

Workarounds

Disable the script coder in policy.xml by adding a rule such as <policy domain="coder" rights="none" pattern="SCRIPT" /> until patches are deployed
Remove or restrict execution permissions on ImageMagick binaries for accounts that do not require them
Sandbox ImageMagick processing with tools such as seccomp, AppArmor, or containers that mount only required directories read-only

bash

# Configuration example: block the script coder in ImageMagick policy.xml
# File: /etc/ImageMagick-7/policy.xml (path varies by distribution)
<policymap>
  <policy domain="coder" rights="none" pattern="SCRIPT" />
  <policy domain="path" rights="none" pattern="@*" />
</policymap>