Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-07-15T11:25:47 ImageMagick: ImageMagick: Information disclosure via policy bypass in -script operation 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CWE-639

ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing security policy checks. This allows reading files from paths that are otherwise disallowed by the configured security policy.

A flaw was found in ImageMagick. A local attacker with low privileges can exploit a policy bypass vulnerability in the `-script` operation due to missing security policy checks. This allows the attacker to read files from paths that are otherwise disallowed by the configured security policy, leading to information disclosure.

Red Hat Enterprise Linux ships ImageMagick in RHEL 6 ELS and RHEL 7 ELS. This flaw has been rated as having a Low security impact and is not currently planned to be addressed in future updates of those products. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/. Restrict use of the -script option by ensuring untrusted users cannot invoke ImageMagick commands directly. If ImageMagick is used in an automated pipeline, use a wrapper that does not pass the -script flag. Upgrade to ImageMagick 7.1.2-26 or 6.9.13-51 mitigates the issue. Red Hat Enterprise Linux 6 Fix deferred ImageMagick Red Hat Enterprise Linux 7 Fix deferred ImageMagick https://www.cve.org/CVERecord?id=CVE-2026-61859 https://nvd.nist.gov/vuln/detail/CVE-2026-61859 https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vghg-5jrg-2398 https://www.vulncheck.com/advisories/imagemagick-before-26-policy-bypass-via-script-operation