CVE-2026-61858 — ImageMagick before 7.1.2-26 Policy Bypass via APNG encoder
ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disa…
Published: 2026-07-11 · CVSS: 4.8 · CVSS 4.0
ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by bypassing configured policy restrictions through the APNG encoding process.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7