CVE-2022-44268

Name of the Vulnerable Software and Affected Versions ImageMagick version 7.1.0-49

Description The issue is related to errors in processing input data, which can allow a remote attacker to access protected information using the profile parameter. When ImageMagick parses a PNG image, the resulting image could have embedded the content of an arbitrary file if the magick binary has permissions to read it.

Recommendations For ImageMagick version 7.1.0-49, consider disabling the processing of external PNG images until a patch is available. Restrict access to the profile parameter to minimize the risk of exploitation. Avoid using the profile parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.