CVE-2026-105081

Publié : 12 octobre 2026

Modifié : 12 octobre 2026

Score CVSS

3.6

LOW

Description détaillée

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to evade the configured policy.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Références et Patchs

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-79p5-w6jv-r997 https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-policy-bypass-via-symlink-in-isrightsauthorizedbyname

Dernières Vulnérabilités

CVE-2026-68764

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

VOIR DÉTAILS

CVE-2026-18390

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor allows OS Command Injection. This issue affects UYAP Document Editor: before 5.4.20.

VOIR DÉTAILS

CVE-2026-12613

Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor allows Object Injection. This issue affects UYAP Document Editor: before 5.4.20.

VOIR DÉTAILS