CVE-2026-61859
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A vulnerability in ImageMagick before versions 7.1.2-26 and 6.9.13-51 allows bypassing security policy in the -script operation. Missing security policy checks enable reading files from paths that are otherwise disallowed.
Risk Assessment
An attacker can read sensitive system files, such as configurations or credentials, leading to information disclosure and potential privilege escalation.
Recommendation
Immediately update ImageMagick to version 7.1.2-26 or later (for the 7.x branch) and 6.9.13-51 or later (for the 6.9.x branch).
Original NVD description (English source)
ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing security policy checks. This allows reading files from paths that are otherwise disallowed by the configured security policy.