PT-2026-48567 · Unknown+1 · Imagemagick+1

CVE-2026-49219 · Published 2026-05-30 · Updated 2026-07-08

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 6.9.13-48 ImageMagick versions prior to 7.1.2-24

Description Incorrect parsing of the filename allows a policy bypass, enabling the reading of files disallowed by a security policy through the use of a symlink (a symbolic link that acts as a reference to another file or directory).

Recommendations Update to version 6.9.13-48. Update to version 7.1.2-24.

Exploit

Fix

DoS

Path traversal

Information Disclosure

Incorrect Authorization

OS Command Injection

Weakness Enumeration

CWE-22

CWE-200

CWE-863

CWE-78

Related Identifiers

BDU:2026-10447

CVE-2026-49219

ECHO-4821-3282-7AF1

GHSA-XCJM-WQFF-M669

OESA-2026-2555

OPENSUSE-SU-2026:11061-1

Affected Products

Imagemagick

Red Os

References · 50

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49219.json · Exploit
• https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xcjm-wqff-m669 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48733 · Security Note
• https://osv.dev/vulnerability/CVE-2026-49219 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2555 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-10447 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-48724 · Security Note
• http://repo.red-soft.ru/redos/8.0/x86_64/updates · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-49219 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xcjm-wqff-m669 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-49219 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-49219 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-49218 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-48734 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-49219 · Vendor Advisory