CVE-2026-25965: 
C# vulnerability analysis and mitigation

CVE-2026-25965 is a path traversal vulnerability in ImageMagick that allows attackers to bypass the software's security policy enforcement and read sensitive files (Local File Disclosure / LFI). The flaw affects ImageMagick versions prior to 7.1.2-15 (7.x branch) and prior to 6.9.13-40 (6.x branch), as well as Magick.NET NuGet packages prior to version 14.10.3. It was published on February 23–24, 2026, with patches released simultaneously. The CVSS v3.1 base score is 8.6 (High) per the GitHub Security Advisory, reflecting a network-accessible, unauthenticated attack with a scope change (Github Advisory, Red Hat Bugzilla).

The root cause (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) lies in how ImageMagick applies its security policy: the policy matcher evaluates the raw, unnormalized filename string before the operating system resolves it. This means a policy rule such as deny path /etc/* can be circumvented by supplying a path traversal sequence (e.g., /tmp/../../etc/passwd), because the policy engine sees only the unnormalized path and permits the operation, while the OS resolves and opens the actual sensitive file. No authentication or special privileges are required to exploit this in contexts where user-controlled filenames are passed to ImageMagick (e.g., web applications processing uploaded images). The vulnerability was reported by researcher "Ap4sh" and disclosed via the ImageMagick GitHub Security Advisory (Github Advisory, ImageMagick Advisory).

Successful exploitation enables local file disclosure (LFI), allowing an attacker to read arbitrary files accessible to the ImageMagick process — including sensitive system files such as /etc/passwd, /etc/shadow, application configuration files, or private keys — even when policy-secure.xml is applied. The confidentiality impact is rated High, with no direct integrity or availability impact. In web application contexts where ImageMagick processes user-supplied filenames, this vulnerability can be exploited remotely and unauthenticated, potentially exposing credentials or secrets that enable further lateral movement (Github Advisory, Red Hat Bugzilla).

1. Identify target: Locate a web application or service that passes user-controlled filenames to ImageMagick for processing (e.g., image conversion endpoints), running a vulnerable version (ImageMagick < 7.1.2-15 or < 6.9.13-40).
2. Craft traversal path: Construct a filename containing path traversal sequences that resolve to a sensitive file, such as /tmp/../../etc/passwd or ./subdir/../../../etc/shadow, designed to bypass the policy pattern /etc/*.
3. Submit payload: Supply the crafted filename as input to the ImageMagick-processing endpoint (e.g., via a file upload form, API parameter, or command-line argument in a multi-user environment).
4. Policy bypass occurs: ImageMagick's policy engine evaluates the raw unnormalized string (e.g., /tmp/../../etc/passwd), which does not match the /etc/* deny rule, so the operation is permitted.
5. OS resolves path: The operating system resolves the traversal and opens /etc/passwd; ImageMagick reads and processes the file content.
6. Exfiltrate data: The attacker retrieves the file contents through the application's response (e.g., as image metadata, error messages, or converted output) (Github Advisory, ImageMagick Advisory).

• Logs: ImageMagick process logs or application logs showing filenames containing ../ or ..\ sequences, especially those resolving to sensitive directories (/etc/, /root/, /home/, /var/).
• Logs: Web server access logs with requests to image-processing endpoints containing encoded traversal sequences (%2e%2e%2f, %2e%2e/, ..%2f) in filename parameters.
• File System: Unexpected access timestamps on sensitive files (e.g., /etc/passwd, /etc/shadow, application config files) coinciding with ImageMagick process activity.
• Process: ImageMagick (convert, magick) spawned with arguments containing path traversal patterns pointing outside expected working directories.

Upgrade ImageMagick to version 7.1.2-15 or later (7.x branch) or 6.9.13-40 or later (6.x branch). For Magick.NET users, upgrade to 14.10.3 or later. As an additional hardening measure — particularly to prevent write operations — add explicit deny rules for sensitive paths in your policy.xml (e.g., <policy domain="path" rights="none" pattern="/etc/*"/> and similar for other sensitive directories); this will also be included in ImageMagick's default secure policies going forward. Red Hat Enterprise Linux 7 Extended Lifecycle Support users can apply the fix via errata RHSA-2026:5573. Debian, SUSE, Ubuntu, and Amazon Linux 2 have also released updated packages (Github Advisory, Red Hat Bugzilla, Red Hat Errata).

The vulnerability received coverage from The Hacker Wire, which published a dedicated write-up on the LFI-via-path-traversal policy bypass (The Hacker Wire). Social media activity was observed on Mastodon and Bluesky shortly after disclosure. Linux distribution security teams (Debian, SUSE, Ubuntu, Oracle Linux, Amazon Linux) responded promptly with updated packages across multiple releases, reflecting the broad deployment footprint of ImageMagick. Red Hat assigned the issue high severity and addressed it via an errata for RHEL 7 ELS.