CVE-2022-24720

Name: CVE-2022-24720
Creator: NVD / NIST
Published: 2022-03-01T23:15:08.993+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.8/10EPSS 2.60%

Last modified Jun 17, 2026

CVE-2022-24720 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the `#apply` method from image_processing to apply a series of operations that are coming from unsanitized user input allows the attacker to execute shell commands. EPSS estimates a 2.60% chance of exploitation in the next 30 days.

Description

image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the `#apply` method from image_processing to apply a series of operations that are coming from unsanitized user input allows the attacker to execute shell commands. This method is called internally by Active Storage variants, so Active Storage is vulnerable as well. The vulnerability has been fixed in version 1.12.2 of image_processing. As a workaround, users who process based on user input should always sanitize the user input by allowing only a constrained set of operations.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

2.60%

83.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-20

Affected Software

Vendor	Product	Versions
Image Processing Project	Image Processing	< 1.12.2
Debian	Debian Linux	11.0

References

https://github.com/janko/image_processing/commit/038e4574e8f4f4b636a62394e09983c71980dadaPatch
https://github.com/janko/image_processing/security/advisories/GHSA-cxf7-qrc5-9446Exploit, Vendor Advisory
https://www.debian.org/security/2022/dsa-5310Third Party Advisory
https://github.com/janko/image_processing/commit/038e4574e8f4f4b636a62394e09983c71980dadaPatch
https://github.com/janko/image_processing/security/advisories/GHSA-cxf7-qrc5-9446Exploit, Vendor Advisory
https://www.debian.org/security/2022/dsa-5310Third Party Advisory

Timeline

Published: Mar 1, 2022
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2022-24720?

How severe is CVE-2022-24720?

CVE-2022-24720 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 2.60% probability of exploitation in the next 30 days.

How do I fix CVE-2022-24720?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-24720?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST