PT-2026-110691 · Unknown · Imagemagick
CVSS v3.1
2.5
Low
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
ImageMagick versions prior to 7.1.2-32
Description
A time-of-check time-of-use (TOCTOU) symlink race occurs when executing a magick script. This allows attackers to bypass the path security policy by swapping a checked path with a symlink during execution, enabling the reading of files that the security policy is intended to block.
Recommendations
Update to version 7.1.2-32 or later.
Exploit
Fix
Link Following
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Imagemagick