CVE-2026-105081— ImageMagick before 7.1.2-33 Policy Bypass via Symlink in IsRightsAuthorizedByName
Quick assessment
Affected
ImageMagick ImageMagick
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 ImageMagick 6.9.13-58 之前的版本以及 7.x 系列中早于 7.1.2-33 的版本中， 安全策略检查未正确处理符号链接，导致可绕过配置的访问控制策略限制。本地攻击者若能创建符号链接，可将其指向受策略限制的路径，从而规避所配置的安全策略。
Affected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| ImageMagick | ImageMagick | < 7.1.2-33 |
affected |
7.1.2-33 |
unaffected | ||
< 6.9.13-58 |
affected | ||
6.9.13-58 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-105081
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ImageMagick before 7.1.2-33 Policy Bypass via Symlink in IsRightsAuthorizedByName
Source: CVE Program / CVE List V5
Vulnerability Description
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to evade the configured policy.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在文件访问前对链接解析不恰当(链接跟随)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ImageMagick | ImageMagick | 0 ~ 7.1.2-33 | - |
|
| ImageMagick | ImageMagick | 0 ~ 6.9.13-58 | - |
|
II. Public POCs for CVE-2026-105081
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-105081
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-105081 (2)
Same Patch Batch · ImageMagick · 2026-10-12 · 26 CVEs total
| CVE-2026-109266 | 5.3 MEDIUM | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Code Injection via CIP Encoder |
| CVE-2026-109259 | 5.3 MEDIUM | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in TGA Decoder |
| CVE-2026-109273 | 5.3 MEDIUM | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in PostScript |
| CVE-2026-109276 | 5.3 MEDIUM | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Temporary File Leak in JNG Decoder |
| CVE-2026-109262 | 5.3 MEDIUM | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in SVG Encoder |
| CVE-2026-109265 | 5.3 MEDIUM | ImageMagick 7.1.1-7 before 7.1.2-32 Heap Buffer Over-Read via XMP Profile |
| CVE-2026-109267 | 5.3 MEDIUM | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MSL Decoder |
| CVE-2026-109269 | 5.3 MEDIUM | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure via JPEG Decod |
| CVE-2026-109275 | 4.8 MEDIUM | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Code Injection via MVG Decoder |
| CVE-2026-109281 | 4.4 MEDIUM | ImageMagick 7.1.0-21 before 7.1.2-32 Heap Buffer Over-Read via -fx Option |
| CVE-2026-109264 | 3.7 LOW | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Stack Overflow in MVG Decoder |
| CVE-2026-109263 | 3.7 LOW | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in YUV Encoder |
| CVE-2026-109260 | 3.7 LOW | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in PNG Encoder |
| CVE-2026-109272 | 3.7 LOW | ImageMagick 7.1.1-31 before 7.1.2-32 Null Pointer Dereference in PostScript Decoder |
| CVE-2026-109271 | 3.7 LOW | ImageMagick 7.1.2-30 before 7.1.2-32 Use After Free in WBINFO Decoder |
| CVE-2026-109278 | 3.7 LOW | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in Wavelet-Denoise Operat |
| CVE-2026-109261 | 3.7 LOW | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory Leak in GIF Encoder |
| CVE-2026-109268 | 3.7 LOW | ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Use After Free in PDF Writer via JPEG |
| CVE-2026-109277 | 3.3 LOW | ImageMagick before 7.1.2-32 Policy Bypass via -script Operation |
| CVE-2026-109270 | 3.3 LOW | ImageMagick before 7.1.2-32 Memory Leak via -process Option |
Showing top 20 of 26 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: ImageMagick
-
CVE-2026-109964
ImageMagick before 7.1.2-33 and 6.9.13-58 Heap Buffer Underw -
CVE-2026-109281
ImageMagick 7.1.0-21 before 7.1.2-32 Heap Buffer Over-Read v -
CVE-2026-109282
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Undefin -
CVE-2026-109280
ImageMagick 7.1.0-20 before 7.1.2-32 Use After Free via -fx -
CVE-2026-109279
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Heap Bu
Same vendor: ImageMagick
-
CVE-2026-109964
ImageMagick before 7.1.2-33 and 6.9.13-58 Heap Buffer Underw -
CVE-2026-109281
ImageMagick 7.1.0-21 before 7.1.2-32 Heap Buffer Over-Read v -
CVE-2026-109282
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Undefin -
CVE-2026-109280
ImageMagick 7.1.0-20 before 7.1.2-32 Use After Free via -fx -
CVE-2026-109278
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Memory
Same weakness: CWE-59
-
CVE-2026-55480
CUPS copy_model() creates a predictable PPD tempfile without -
CVE-2026-53882
Path Traversal in Virtualization Station VM Import -
CVE-2026-110860
GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Sub -
CVE-2026-104109
FileRise: Authenticated ZIP extraction follows a pre-existin -
CVE-2026-55498
FileRise Shared Folder Symlink Escape
V. Comments for CVE-2026-105081
No comments yet