Loading story…
Web applications that process user-uploaded images with ImageMagick can expose a broad attack surface when upload controls rely on file extensions or weak type checks. Research describing Rails applications using CarrierWave and MiniMagick showed that attackers may influence both the input and output formats passed to ImageMagick, enabling abuse of vulnerable coders and delegates beyond expected image types. The reports warned that ImageMagick has a long history of flaws including denial of service, memory corruption, and possible code execution, and demonstrated that output formats such as INFO and EPS3 can leak absolute server paths and ImageMagick version details into generated files.
The findings align with OWASP guidance on unrestricted file upload, which says unsafe upload handling can lead to code execution, information disclosure, client-side attacks, malware hosting, and service disruption. One proof of concept showed that a crafted JPEG of only about 5 KB, with manipulated dimensions of 64250 x 64250, could drive ImageMagick to allocate roughly 33 GB of pixel cache and destabilize a host. Recommended defenses included strict allow-listing of formats such as JPEG, GIF, and PNG; validating magic bytes against extensions before processing; enforcing policy.xml resource limits and execution timeouts; restricting upload size; using non-executable and isolated storage; sandboxing image processing; limiting concurrency; and keeping ImageMagick updated.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
OWASP published guidance describing unrestricted file upload as a high-severity web application vulnerability, outlining attack paths such as code execution, XSS, denial of service, information disclosure, and abuse of server-side libraries including ImageMagick. The document also recommended layered mitigations including strict allow lists, filename sanitization, isolated storage, size limits, and secure response handling.
MBSD published a follow-up analysis focused on denial-of-service attacks against Passenger, CarrierWave, MiniMagick, and ImageMagick stacks, including JPEG pixel flood, GIF flooding, and PNG compression cases. It showed that small crafted files could trigger extreme CPU, memory, disk I/O, and processing-time consumption, and recommended resource limits, timeouts, upload-size restrictions, and cgroup isolation.
MBSD published an analysis of web applications using CarrierWave with ImageMagick, showing that default behavior can let attackers influence both input and output formats through file content and filename extension. The article highlighted exposure to numerous ImageMagick vulnerabilities and demonstrated that certain output formats such as INFO and EPS3 can leak server-side paths and version information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
owasp.org
Open sourcembsd.jp
Open sourcembsd.jp
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers described how weak image-upload controls can let attackers submit files with benign-looking extensions such as `.jpg` while embedding active content that browsers may execute under the victim site’s origin context. One technique abuses browser content handling with tags such as `OBJECT` to force interpretation of uploaded content as Flash or other active formats, allowing a malicious file hosted on a trusted site to send authenticated requests with the victim’s cookies and read sensitive responses such as profile data or CSRF tokens. The same class of issue can also support follow-on CSRF-style actions when a logged-in user is lured to an attacker-controlled page. Separate analysis of web applications using ImageMagick and CarrierWave showed that insecure defaults can widen the exposure by storing uploaded files and temporary cache files in publicly reachable directories, sometimes without reliable access control. The research found that obscure image formats and malformed payloads can trigger browser-side script execution when servers return incorrect or missing `Content-Type` headers, and that leftover cache files after validation or conversion failures may remain accessible if their URLs are guessable. Recommended defenses include validating file content as well as extensions, restricting accepted formats, serving uploads with correct MIME types, enabling `X-Content-Type-Options: nosniff`, and moving protected uploads and caches outside public web paths.
Aug 15, 2026
Multiple **ImageMagick** vulnerabilities were disclosed affecting common image-processing deployments (web apps, CMS integrations, and automated pipelines). **CVE-2026-25794** is a heap-based buffer overflow triggered when writing UHDR images: `WriteUHDRImage` (`coders/uhdr.c`) uses 32-bit `int` arithmetic to compute pixel buffer size, allowing a signed integer overflow on large dimensions that leads to an undersized heap allocation and out-of-bounds write; ImageMagick **7.1.2-15** includes a patch. Separately, Belgium’s CCB warned that **CVE-2026-23876** is a high-severity heap buffer overflow in the XBM decoder (`ReadXBMImage`) that can be triggered by a crafted image and may enable memory corruption and potential code execution; the advisory notes a **public PoC** and urges immediate patching. A second ImageMagick issue, **CVE-2026-25965**, allows a **policy bypass via path traversal** because the path security policy is applied to the raw filename string before filesystem normalization; attackers can use traversal to read sensitive files (local file disclosure) even when `policy-secure.xml` is in place. Fixes were reported in **ImageMagick 7.1.2-15** and **6.9.13-40**, and guidance indicates policy hardening may be required to ensure write operations are also blocked. A separate disclosure for **Traccar** stored XSS via malicious SVG upload is unrelated to the ImageMagick issues and should be tracked independently.
Jun 29, 2026
dCERT issued two advisories on **multiple vulnerabilities in ImageMagick**, the widely used image processing suite, indicating ongoing security issues affecting the software. The advisories, `2026-0474` and `2026-0633`, both identify ImageMagick as the impacted product but do not provide public synopses, suggesting organizations should review the vendor and downstream security guidance directly for affected versions and technical details. Because ImageMagick is commonly embedded in web applications, content management systems, and backend media-processing pipelines, unpatched flaws can create risk across a broad range of environments. Security teams should inventory systems and applications that rely on ImageMagick, monitor for updated package releases and distribution-specific patches, and prioritize remediation to reduce exposure from potential image parsing and processing attacks.
Jun 29, 2026