Description

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to evade the configured policy.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.6",
  "pubDate": "2026-10-12T13:17:25.590Z",
  "pubdate": "2026-10-12T13:17:25.590Z",
  "executiveSummary": "A security policy bypass vulnerability exists in the IsRightsAuthorizedByName function within ImageMagick versions prior to 6.9.13-58 and 7.x before 7.1.2-33. The vulnerability stems from the improper handling of symbolic links during security policy validation checks.\nThis flaw allows local attackers to evade established security policy restrictions by utilizing symlinks to point to paths that would otherwise be restricted by the application configuration.\nThe primary impact of this vulnerability is the potential for unauthorized file access or operations that bypass administrative security controls. Exploitation requires the attacker to have the capability to create symbolic links on the local file system. This vulnerability poses a risk to environments where ImageMagick is used to process files uploaded or managed by untrusted users, as it undermines the integrity of the security policy enforcement mechanism.\nSuccessful exploitation facilitates unauthorized interactions with sensitive system paths that the security policy was intended to protect, potentially leading to unauthorized data exposure or further system exploitation depending on the specific policy configuration.",
  "technicalDetails": "The vulnerability is localized within the IsRightsAuthorizedByName function, which is responsible for evaluating whether a requested operation or file access complies with the user-defined security policy configured in ImageMagick. The core issue is a failure in the logic to properly resolve or validate symbolic links during path authorization checks.\nWhen ImageMagick processes a request to access a specific resource, it triggers the IsRightsAuthorizedByName function to perform a check against the configured policy. The current implementation does not adequately account for symbolic links when verifying path-based restrictions. An attacker can leverage this by creating a symbolic link that points to a restricted resource or file. When ImageMagick attempts to validate the path, the resolution process fails to identify the underlying target of the symlink, instead verifying the path of the symlink itself or incorrectly processing the resolution chain.\nThe exploitation flow is as follows: 1) An attacker identifies a target path that is restricted by the ImageMagick security policy. 2) The attacker creates a symbolic link in a directory accessible to the ImageMagick process, pointing the link toward the restricted target. 3) The attacker submits an image processing request to ImageMagick, providing the path of the symlink as the input or source file. 4) The IsRightsAuthorizedByName function performs a validation check on the symlink path rather than the canonical path of the target file. 5) Because the symlink name itself does not match the restricted patterns defined in the policy, the security check returns a successful authorization result. 6) ImageMagick proceeds to operate on the target file, bypassing the security policy constraint entirely.\nThis vulnerability affects ImageMagick versions prior to 6.9.13-58 and 7.x before 7.1.2-33. It does not require remote authentication, as the attack vector is local to the filesystem where the attacker can define symlinks. The risk is highly dependent on the local environment and the specific configuration of the ImageMagick policy files (e.g., policy.xml). By bypassing these checks, an attacker may be able to read sensitive system files or interact with restricted resources, effectively elevating their access beyond the limits intended by the security policy."
}