Is Magick.NET-Q16-AnyCPU affected by CVE-2026-49219?

NuGet Magick.NET-Q16-AnyCPU is affected in < 14.14.0.

Is CVE-2026-49219 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.2%.

medium

CVE-2026-49219

Q: Is CVE-2026-49219 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.2%.

NuGet · Magick.NET-Q16-AnyCPU

Summary

ImageMagick: Policy Bypass can read disallowed files via symlink

Severity: medium
CVSS: 5.5
EPSS: 0.2% (p7)
CWE: CWE-22, CWE-78, CWE-200, CWE-863
Also known as: GHSA-xcjm-wqff-m669#Magick.NET-Q16-AnyCPU
Published: 2026-06-25
Updated: 2026-06-25

Advisory details

An incorrect parsing of the filename can result in a policy bypass and read files disallowed by a security policy using a symlink.

References

Related advisories

CVE-2026-75859 — high · crates.io/deepseek-tui
CVE-2026-55485 — high · PyPI/piccolo-admin
GHSA-rr55-jp92-8wp2 — high · npm/claude-faf-mcp
GHSA-j4r7-8ph4-43g3 — high · npm/faf-mcp
GHSA-cc2g-gq8c-r332 — high · npm/grok-faf-mcp
CVE-2026-87017 — medium · PyPI/open-webui
GHSA-mf8r-wm2w-f8c5#phpmyfaq/phpmyfaq — medium · Packagist/phpmyfaq/phpmyfaq
GHSA-mf8r-wm2w-f8c5#thorsten/phpmyfaq — medium · Packagist/thorsten/phpmyfaq

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.