Missing policy checks in -concatenate operation before 7.1.2-26 (fixed)
CVE-2026-55628 Published on July 1, 2026
ImageMagick: Policy Bypass in concatenate operation due to missing checks
In versions prior to 7.1.2-26he, the `-concatenate` operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. This issue has been fixed in version 7.1.2-26.
Vulnerability Analysis
CVE-2026-55628 is exploitable with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Types
External Control of File Name or Path
The software allows user input to control or influence paths or file names that are used in filesystem operations.
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-55628 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-55628
Want to know whenever a new CVE is published for ImageMagick? stack.watch will email you.
