---
id: CVE-2026-56377
title: ImageMagick - Policy Bypass via Incorrect Path Validation
summary: >-
  ImageMagick before 7.1.2-24 contains an incorrect policy check that allows
  attackers to create or truncate files disallowed by security policies. Remote
  attackers can bypass path policy restrictions in sandboxed conversion services
  to wr…
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-22
vendor: ImageMagick
product: ImageMagick
affected:
  - ImageMagick >= 7.0.0 < 7.1.2-24
  - ImageMagick < 6.9.13-48
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-01T14:55:12.976900Z'
published: '2026-06-30'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T21:15:56.674Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-56377'
references:
  - url: >-
      https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gm48-c7f2-v67p
    label: GitHub Security Advisory (GHSA-gm48-c7f2-v67p)
  - url: >-
      https://www.vulncheck.com/advisories/imagemagick-policy-bypass-via-incorrect-path-validation
    label: >-
      VulnCheck Advisory: ImageMagick - Policy Bypass via Incorrect Path
      Validation
tags:
  - cve.org
epss: 0.00164
epssPercentile: 0.05682
ingestedAt: '2026-11-03T08:39:35.563Z'
---

## Overview

ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or truncate files disallowed by security policies. Remote attackers can bypass path policy restrictions in sandboxed conversion services to write arbitrary files outside intended boundaries.

## Affected

- `ImageMagick >= 7.0.0 < 7.1.2-24`
- `ImageMagick < 6.9.13-48`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.