CVE-2026-49219
ImageMagick: ImageMagick: Information disclosure via incorrect filename parsing
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · June 11, 2026
Updated · August 19, 2026
Description
A flaw was found in ImageMagick, a free and open-source software used for editing and manipulating digital images. An attacker with local access could exploit an incorrect parsing of filenames to bypass security policies. This could allow the attacker to read files that are otherwise disallowed by the system's security configuration, leading to information disclosure.
Statement
This flaw in ImageMagick is rated as Low impact. It allows an attacker with local access and high privileges to bypass security policies through incorrect filename parsing. This could lead to the disclosure of files that are otherwise protected by the system's security configuration.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 4.2CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
CWE-59 · Improper Link Resolution Before File Access ('Link Following')