CVE-2026-55628: ImageMagick Policy Bypass in -concatenate Operation

Technical summary

CVE-2026-55628 is a policy enforcement bypass in ImageMagick's concatenate image operation. The `-concatenate` function does not properly validate file paths against the configured security policy before accessing the filesystem. This allows both read and write operations on files and directories that should be blocked by policy rules. The vulnerability affects versions prior to 7.1.2-26. The issue is classified as CWE-73 (External Control of File Name or Path) and CWE-862 (Missing Authorization), indicating inadequate access control mechanisms.

Business impact

Organizations using ImageMagick for automated image processing or as part of a service (such as image conversion APIs, document rendering systems, or content management platforms) face potential data exposure if an attacker submits a malicious image that causes the tool to read sensitive files. Additionally, policy-constrained ImageMagick deployments designed to sandbox image processing lose that protection, potentially allowing unauthorized file modification or deletion. The actual business risk depends heavily on whether ImageMagick runs with elevated privileges, how user-supplied content reaches it, and what files it has access to.

Affected systems

ImageMagick versions prior to 7.1.2-26 are affected. The vulnerability requires local code execution or user interaction with untrusted image files. Organizations should inventory ImageMagick deployments across development tools, server-side image processing pipelines, container images, and systems where it may be embedded as a dependency. Both direct command-line usage and library integration via bindings (Python, Ruby, PHP, etc.) are in scope.

Exploitability

Exploitability is moderate and requires user interaction. An attacker cannot remotely trigger this flaw by simply sending a network request; they must either convince a user to process a crafted image or submit a malicious image to a service that processes user uploads. The attack surface is local (requires filesystem access to paths that would normally be blocked). No known public exploit code or active exploitation in the wild has been confirmed at this time.

Remediation

Upgrade ImageMagick to version 7.1.2-26 or later. Prior to patching, restrict ImageMagick's filesystem permissions using operating system controls (file permissions, AppArmor, SELinux) and avoid processing untrusted image files in production environments. Validate and sanitize image file sources before processing.

Patch guidance

Upgrade to ImageMagick 7.1.2-26 or any release version after this patch. Verify the installed version using `identify -version` or your package manager. Most Linux distributions will publish updates through their security repositories. Verify against the official ImageMagick website (imagemagick.org) for the latest stable release and security advisories. Coordinate upgrades with testing to ensure compatibility with dependent applications and custom workflows.

Detection guidance

Monitor for ImageMagick process execution with unusual file paths or the `-concatenate` flag applied to untrusted image sources. Review container images and build artifacts for vulnerable ImageMagick versions. Audit system logs for unauthorized file access attempts from ImageMagick processes. In web services, log and alert on image upload attempts that contain suspicious path traversal patterns or unusual concatenation operations.

Why prioritize this

Although the CVSS score is moderate (5.5), prioritize this based on your organization's specific usage of ImageMagick. If it processes user-supplied images, runs as a service, or has access to sensitive data, this becomes high priority due to policy bypass implications. If ImageMagick is isolated to development tools on restricted systems, priority can be lower. The lack of KEV status and public exploitation suggests less immediate pressure than zero-day variants, but policy-bypass vulnerabilities warrant timely attention.

Risk score, explained

The CVSS 3.1 score of 5.5 (Medium) reflects a local attack vector (AV:L), low complexity (AC:L), no privilege requirement (PR:N), but requiring user interaction (UI:R). The severity is anchored by high availability impact (A:H)—the ability to delete or corrupt files—while integrity and confidentiality impacts are not directly scored. The moderate score does not capture the full policy-bypass nature; organizations relying on ImageMagick's policy mechanism for isolation should treat this as more severe in their context.

Frequently asked questions