What is CVE-2026-61859?

CVE-2026-61859 is a low-severity vulnerability in Imagemagick, classified under Improper Link Resolution Before File Access. CVSS score: 3.3/10. Published 2026-07-15.

How severe is CVE-2026-61859?

Low severity. CVSS v3 base score is 3.3 out of 10.

Vulnerability in Imagemagick

CVE-2026-61859

ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing security policy checks. This allows reading files from paths that are otherwise disallowed by the conf…

CVSS v3 metric

CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

Affected products

Imagemagick — versions 0, 7.1.2-26, 6.9.13-51

Weakness classification (CWE)

CWE-59 — Improper Link Resolution Before File Access

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-61859?: CVE-2026-61859 is a low-severity vulnerability in Imagemagick, classified under Improper Link Resolution Before File Access. CVSS score: 3.3/10. Published 2026-07-15.
How severe is CVE-2026-61859?: Low severity. CVSS v3 base score is 3.3 out of 10.