CVE-2026-28689

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, domain="path" authorization is checked before final file open/use. A symlink swap between check-time and use-time bypasses policy-denied read/write. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41.

• CWE-59
• CWE-367

• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-493f-jh8w-qhx3Vendor Advisory

Published

Mar 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28683Gokapi is a self-hosted file sharing server with automatic e…8.7
• CVE-2026-28684python-dotenv reads key-value pairs from a .env file and can…6.6
• CVE-2026-28685Kimai is a web-based multi-user time-tracking application. P…6.5
• CVE-2026-28686ImageMagick is free and open-source software used for editin…6.8
• CVE-2026-28687ImageMagick is free and open-source software used for editin…5.3
• CVE-2026-28688ImageMagick is free and open-source software used for editin…5.3
• CVE-2026-2869A vulnerability was identified in janet-lang janet up to 1.4…5.5
• CVE-2026-28690ImageMagick is free and open-source software used for editin…6.5
• CVE-2026-28691ImageMagick is free and open-source software used for editin…7.5
• CVE-2026-28692ImageMagick is free and open-source software used for editin…4.8
• CVE-2026-28693ImageMagick is free and open-source software used for editin…8.1
• CVE-2026-28695Craft is a content management system (CMS). There is an auth…7.2