What is GHSA-26m2-2whw-vfv9?

GHSA-26m2-2whw-vfv9 is a security advisory published by GitHub Security Advisories with Medium severity. ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and...

Which CVE IDs does GHSA-26m2-2whw-vfv9 cover?

GHSA-26m2-2whw-vfv9 covers the following CVE IDs: CVE-2026-61858. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-26m2-2whw-vfv9?

GHSA-26m2-2whw-vfv9 has a CVSS v3 base score of 3.3, published by GitHub Security Advisories.

GHSA-26m2-2whw-vfv9MediumCVSS 3.3

ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and...

Vendor

GitHub Security Advisories

Published

July 11, 2026

Last Modified

July 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-61858 →

📋 Description

ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by bypassing configured policy restrictions through the APNG encoding process.

🔗 References (4)

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v3j6-27vc-7pw2
https://nvd.nist.gov/vuln/detail/CVE-2026-61858
https://www.vulncheck.com/advisories/imagemagick-before-26-policy-bypass-via-apng-encoder
https://github.com/advisories/GHSA-26m2-2whw-vfv9