PT-2026-3024 · Imagick+1 · Imagick+1

Published 2026-01-15 · Updated 2026-01-21 · CVE-2025-67079

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Omnispace Agora Project versions prior to 25.10

Description A file upload issue exists in Omnispace Agora Project. Attackers can potentially execute code by uploading a specially crafted PDF file. This is possible through the MSL engine of the Imagick library, specifically within the file upload and thumbnail functions.

Recommendations Update Omnispace Agora Project to version 25.10 or later.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-67079

Affected Products

Imagick

Omnispace Agora Project

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-67079 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67079 · Vendor Advisory
• https://twitter.com/CveFindCom/status/2011840581727588769 · Twitter Post
• https://twitter.com/TheHackerWire/status/2011843401239699577 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2011843697898320120 · Twitter Post
• https://t.me/cveNotify/149387 · Telegram Post
• https://agora-project.net · Note
• https://twitter.com/CVEnew/status/2012490388657803508 · Twitter Post
• https://helx.io/blog/advisory-agora-project · Note