A AegiFlow
LOWCVSS 3.3

GHSA-v3j6-27vc-7pw2

ImageMagick: Policy Bypass in APNG encoder and delegates due to a missing check

Published
2026-07-24
Modified
2026-07-24
Sources
github-advisory

Summary

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Affected packages

EcosystemPackageAffected versionsFixed versions
NuGetMagick.NET-Q16-AnyCPU14.15.0
NuGetMagick.NET-Q16-HDRI-AnyCPU14.15.0
NuGetMagick.NET-Q16-HDRI-OpenMP-arm6414.15.0
NuGetMagick.NET-Q16-HDRI-x6414.15.0
NuGetMagick.NET-Q16-HDRI-x8614.15.0
NuGetMagick.NET-Q16-OpenMP-arm6414.15.0
NuGetMagick.NET-Q16-OpenMP-x6414.15.0
NuGetMagick.NET-Q16-arm6414.15.0
NuGetMagick.NET-Q16-x6414.15.0
NuGetMagick.NET-Q16-x8614.15.0
NuGetMagick.NET-Q8-AnyCPU14.15.0
NuGetMagick.NET-Q8-OpenMP-arm6414.15.0
NuGetMagick.NET-Q8-OpenMP-x6414.15.0
NuGetMagick.NET-Q8-arm6414.15.0
NuGetMagick.NET-Q8-x6414.15.0
NuGetMagick.NET-Q8-x8614.15.0
NuGetMagick.NET-Q16-HDRI-arm6414.15.0

Remediation: Upgrade to 14.15.0 or later.

References

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.