What is GHSA-gx8j-c5hq-h6p7?

GHSA-gx8j-c5hq-h6p7 is a security advisory published by GitHub Security Advisories with Low severity. ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links...

Which CVE IDs does GHSA-gx8j-c5hq-h6p7 cover?

GHSA-gx8j-c5hq-h6p7 covers the following CVE IDs: CVE-2026-105081. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gx8j-c5hq-h6p7?

GHSA-gx8j-c5hq-h6p7 has a CVSS v3 base score of 3.6, published by GitHub Security Advisories.

GHSA-gx8j-c5hq-h6p7LowCVSS 3.6

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links...

Vendor

GitHub Security Advisories

Published

October 12, 2026

Last Modified

October 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-105081 →

📋 Description

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to evade the configured policy.

🔗 References (4)

https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-79p5-w6jv-r997
https://nvd.nist.gov/vuln/detail/CVE-2026-105081
https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-policy-bypass-via-symlink-in-isrightsauthorizedbyname
https://github.com/advisories/GHSA-gx8j-c5hq-h6p7