CVE-2026-105081
LOW
NVD
CVSS Score
3.6
Severity
LOW
Published
Oct 12, 2026
Vendor
unknown
Description
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to evade the configured policy.