{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/580079#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\n\r\nMultiple arbitrary file read and write vulnerabilities have been identified in applications that use ImageMagick with insufficiently restrictive security policies. Collectively referred to as *ImageTragick2*, these issues arise when ImageMagick processes attacker-controlled SVG or PostScript content using dangerous coders or delegates permitted by its default or application-supplied configuration. An attacker who can upload an image, or otherwise cause an application to process crafted image content, may be able to read or write files accessible to the ImageMagick process. In some deployments, these capabilities may be chained to achieve arbitrary code execution, compromising the confidentiality, integrity, and availability of the affected application and host.\r\n\r\n### Description\r\n\r\n[ImageMagick](https://imagemagick.org/) is a widely used open-source image-processing suite. Web and content-management applications, including Ruby on Rails, WordPress, MediaWiki, ownCloud Classic, and Redmine, may use ImageMagick for operations such as thumbnail generation, cropping, conversion, and transformation. ImageMagick is also commonly included in containerized AI image-processing pipelines. It may operate before inference to normalize or transform inputs, or after inference to convert and prepare generated output. In these environments, images may originate not only from direct uploads but also from URLs, automated agents, datasets, model outputs, or other upstream services.\r\n\r\nTwo vulnerability variants have been identified:\r\n**Coder invocation through SVG (MSL injection)**\r\n\r\nImageMagick's SVG processing can allow a crafted SVG `<image>` element to invoke a dangerous coder through its `xlink:href` value, for example, by referencing an `MSL:` resource. ImageMagick may then interpret the referenced content as a Magick Scripting Language (MSL) script. The script can invoke additional image readers and direct attacker-controlled image data to selected filesystem paths, enabling unauthorized file access. Exploitation depends on the internal SVG coder and the required dangerous coders being available to the ImageMagick process.\r\n\r\n**Ghostscript invocation through content detection**\r\n\r\nImageMagick's content-based format detection may identify crafted input as PostScript and invoke Ghostscript, a separate interpreter used by ImageMagick to handle PostScript, EPS, and PDF, even when the filename or declared type suggests another format. Although Ghostscript is invoked with `-dSAFER`, the observed configuration permits file access within `/tmp`. A crafted PostScript file may therefore read or write data in that directory. This can affect applications that use shared temporary storage for uploaded files, processing artifacts, sessions, or other security-sensitive data.\r\n\r\nThese issues highlight an important aspect of ImageMagick's security model: Behavior that can be restricted through a custom security policy is treated as a configuration issue, not a vulnerability in ImageMagick itself. Applications and distributions are therefore responsible for deploying a policy appropriate to their threat model. Many integrations, however, process untrusted content without a sufficiently restrictive policy.\r\n\r\n### Impact\r\n\r\nAn attacker who can cause an affected application to process crafted SVG or PostScript content may be able to read or write files in directory locations accessible to the ImageMagick process. In some cases, arbitrary code execution is possible when file access can be combined with writable executable content. AI-enabled services that utilize ImageMagick may face additional exposure because of untrusted image processing. In container deployments, writable host mounts, shared volumes, credentials, or inference artifacts can substantially increase the impact of a successful exploit.\r\n\r\n### Solution\r\n\r\nConsult the **Vendor Information** section for product-specific updates and mitigations. Users of products that integrate ImageMagick, including Ruby on Rails, WordPress, MediaWiki, ownCloud Classic, and Redmine, should install vendor-provided updates when available. Updating ImageMagick alone may be insufficient if its security policy continues to permit dangerous coders or delegates.\r\n\r\nApply a custom `policy.xml` based on an allowlist: enable only the formats and operations the application requires, and disable unnecessary coders and delegates, including MSL, MVG, PS, EPS, and PDF. ImageMagick's bundled secure policy template may not be sufficient for every deployment; verify the effective policy and confirm that prohibited formats are rejected.\r\n\r\nAdditional recommendations include:\r\n- Isolate image processing: Process untrusted images in a dedicated, minimally privileged environment with restricted filesystem access. Apply the same controls to AI preprocessing and post-processing pipelines.\r\n- Validate and constrain input: Verify file content rather than relying on filenames, extensions, or client-supplied media types.\r\n- Monitor processing activity: Alert on ImageMagick policy violations, unexpected delegate or coder use, unusual processing failures, and unexpected file creation.\r\n\r\n### Acknowledgements\r\n\r\nThanks to [RyotaK](https://ryotak.net/) of [GMO Flatt Security Inc.](https://flatt.tech/en/) for reporting these vulnerabilities. The pwn.ai team independently discovered Variant 2 and reported it to WordPress as [CVE-2026-65640](https://www.cve.org/CVERecord?id=CVE-2026-65640). This document was written by Vijay Sarvepalli and Molly Jaconski.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"},{"category":"other","text":"Kiteworks has reviewed this report against its products. ownCloud Classic and the Kiteworks platform are affected. We are implementing fixes.\r\n\r\nWe have no indication of exploitation, and will update this statement as remediation ships.","title":"Vendor statment from Kiteworks"},{"category":"other","text":"The Rails team shipped v8.0.5.2 and v8.1.4.1 which includes a policy.xml file for Active Storage's use of mini_magick: https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","title":"Vendor statment from Ruby on Rails"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/580079"},{"url":"https://imagemagick.org/script/security-policy.php","summary":"https://imagemagick.org/script/security-policy.php"},{"url":"https://www.hacktron.ai/blog/hacking-openai","summary":"https://www.hacktron.ai/blog/hacking-openai"},{"url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","summary":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9"}],"title":"Arbitrary file read/write vulnerability in ImageMagick-based applications with default configuration","tracking":{"current_release_date":"2026-11-12T18:12:09+00:00","generator":{"engine":{"name":"VINCE","version":"4.0.3"}},"id":"VU#580079","initial_release_date":"2026-11-12 18:12:09.307439+00:00","revision_history":[{"date":"2026-11-12T18:12:09+00:00","number":"1.20261112181209.1","summary":"Released on 2026-11-12T18:12:09+00:00"}],"status":"final","version":"1.20261112181209.1"}},"vulnerabilities":[{"title":"The automatic file format detection component in ImageMagick versions 7.","notes":[{"category":"summary","text":"The automatic file format detection component in ImageMagick versions 7.1.1.43 and earlier invokes Ghostscript for files detected as PostScript without restricting file I/O operations, which allows remote attackers to write arbitrary files via a crafted PostScript file that uses Ghostscript file operators."}],"ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#580079"}],"product_status":{"known_affected":["CSAFPID-c64f0a30-ded8-11f1-a080-12fffde0a0b9","CSAFPID-c64f347e-ded8-11f1-a080-12fffde0a0b9"],"known_not_affected":["CSAFPID-c64f5ac6-ded8-11f1-a080-12fffde0a0b9"]}},{"title":"ImageMagick versions 7.","notes":[{"category":"summary","text":"ImageMagick versions 7.1.1.43 and earlier ship with a default security policy that does not restrict dangerous coders or file path access, which allows remote attackers to perform arbitrary file operations via crafted image files when applications fail to configure custom restrictive policies, because the ImageMagick security model requires explicit opt-in hardening rather than secure-by-default behavior."}],"ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#580079"}],"product_status":{"known_affected":["CSAFPID-c64fa486-ded8-11f1-a080-12fffde0a0b9","CSAFPID-c64fcace-ded8-11f1-a080-12fffde0a0b9"],"known_not_affected":["CSAFPID-c64ff01c-ded8-11f1-a080-12fffde0a0b9"]}},{"title":"The SVG image processing component in ImageMagick versions 7.","notes":[{"category":"summary","text":"The SVG image processing component in ImageMagick versions 7.1.1.43 and earlier does not properly validate coder prefixes in external image references, which allows remote attackers to write arbitrary files to attacker-controlled paths via a crafted SVG file that references an MSL script without proper authorization checks."}],"ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#580079"}],"product_status":{"known_affected":["CSAFPID-c65037fc-ded8-11f1-a080-12fffde0a0b9","CSAFPID-c65060ec-ded8-11f1-a080-12fffde0a0b9"],"known_not_affected":["CSAFPID-c65089e6-ded8-11f1-a080-12fffde0a0b9"]}}],"product_tree":{"branches":[{"category":"vendor","name":"Kiteworks","product":{"name":"Kiteworks Products","product_id":"CSAFPID-c64f0a30-ded8-11f1-a080-12fffde0a0b9"}},{"category":"vendor","name":"Ruby on Rails","product":{"name":"Ruby on Rails Products","product_id":"CSAFPID-c64f347e-ded8-11f1-a080-12fffde0a0b9"}},{"category":"vendor","name":"Wikimedia Foundation (MediaWiki)","product":{"name":"Wikimedia Foundation (MediaWiki) Products","product_id":"CSAFPID-c64f5ac6-ded8-11f1-a080-12fffde0a0b9"}},{"category":"vendor","name":"Kiteworks","product":{"name":"Kiteworks Products","product_id":"CSAFPID-c64fa486-ded8-11f1-a080-12fffde0a0b9"}},{"category":"vendor","name":"Ruby on Rails","product":{"name":"Ruby on Rails Products","product_id":"CSAFPID-c64fcace-ded8-11f1-a080-12fffde0a0b9"}},{"category":"vendor","name":"Wikimedia Foundation (MediaWiki)","product":{"name":"Wikimedia Foundation (MediaWiki) Products","product_id":"CSAFPID-c64ff01c-ded8-11f1-a080-12fffde0a0b9"}},{"category":"vendor","name":"Kiteworks","product":{"name":"Kiteworks Products","product_id":"CSAFPID-c65037fc-ded8-11f1-a080-12fffde0a0b9"}},{"category":"vendor","name":"Ruby on Rails","product":{"name":"Ruby on Rails Products","product_id":"CSAFPID-c65060ec-ded8-11f1-a080-12fffde0a0b9"}},{"category":"vendor","name":"Wikimedia Foundation (MediaWiki)","product":{"name":"Wikimedia Foundation (MediaWiki) Products","product_id":"CSAFPID-c65089e6-ded8-11f1-a080-12fffde0a0b9"}}]}}