CVE-2026-25965

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick’s path security policy is enforced on the raw filename string before the filesystem resolves it. As a result, a policy rule such as /etc/* can be bypassed by a path traversal. The OS resolves the traversal and opens the sensitive file, but the policy matcher only sees the unnormalized path and therefore allows the read. This enables local file disclosure (LFI) even when policy-secure.xml is applied. Actions to prevent reading from files have been taken in versions .7.1.2-15 and 6.9.13-40 But it make sure writing is also not possible the following should be added to one's policy. This will also be included in ImageMagick's more secure policies by default.

• CWE-22
• CWE-22

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8jvj-p28h-9gm7Third Party Advisory
• https://access.redhat.com/errata/RHSA-2026:5573
• https://access.redhat.com/security/cve/CVE-2026-25965
• https://bugzilla.redhat.com/show_bug.cgi?id=2442118
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25965.json

Published

Feb 24, 2026

Last Modified

Jul 15, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2596Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-25960vLLM is an inference and serving engine for large language m…9.8
• CVE-2026-25961SumatraPDF is a multi-format reader for Windows. In 3.5.0 th…7.5
• CVE-2026-25962MarkUs is a web application for the submission and grading o…6.5
• CVE-2026-25963Fleet is open source device management software. In versions…6.5
• CVE-2026-25964Tandoor Recipes is an application for managing recipes, plan…4.9
• CVE-2026-25966ImageMagick is free and open-source software used for editin…7.8
• CVE-2026-25967ImageMagick is free and open-source software used for editin…7.5
• CVE-2026-25968ImageMagick is free and open-source software used for editin…9.8
• CVE-2026-25969ImageMagick is free and open-source software used for editin…7.5
• CVE-2026-2597Crypt::SysRandom::XS versions before 0.010 for Perl is vulne…7.5
• CVE-2026-25970ImageMagick is free and open-source software used for editin…7.5