CVE-2026-55628

Summary

ImageMagick: Policy Bypass in concatenate operation due to missing checks

Severity

medium

CVSS

6.1

EPSS

0.1% (p1)

CWE

CWE-73, CWE-862

Also known as

GHSA-82mp-vp5c-9pf7#Magick.NET-Q16-AnyCPU

Published

2026-07-24

Updated

2026-07-24

Advisory details

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

References

• https://github.com/advisories/GHSA-82mp-vp5c-9pf7
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-82mp-vp5c-9pf7
• https://nvd.nist.gov/vuln/detail/CVE-2026-55628
• https://github.com/dlemstra/Magick.NET/releases/tag/14.15.0

Related advisories

• CVE-2026-114125 — critical · npm/storybook
• CVE-2026-111058 — critical · PyPI/mercury
• CVE-2026-102748 — critical · Go/github.com/dgraph-io/dgraph/v25
• CVE-2026-105859 — critical · npm/payload
• GHSA-v2f8-6655-7grj — critical · PyPI/vibe-trading-ai
• GHSA-gg6r-gp4c-89hp — critical · npm/trigger.dev
• CVE-2026-61604 — critical · Go/github.com/ixofoundation/ixo-blockchain/v8
• CVE-2026-77244 — critical · PyPI/mcp-atlassian

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity