Loading vulnerability…
ImageTragick is a remote code execution vulnerability in ImageMagick affecting versions before 6.9.3-10 and 7.x before 7.0.1-1. The flaw resides in ImageMagick’s handling of several coders, including EPHEMERAL, HTTPS, MVG, MSL, TEXT, SHOW, WIN, and PLT, where attacker-controlled image content can be incorporated into shell command execution without proper neutralization of shell metacharacters. A specially crafted image, particularly one using MVG or related delegate-processing paths, can trigger command injection when a vulnerable application parses or transforms the file. Because ImageMagick may identify and process files by content rather than extension, exploitation can occur even when the uploaded file appears to have a benign image extension. Successful exploitation can result in arbitrary command execution in the security context of the ImageMagick process and may lead to full system compromise depending on deployment privileges and surrounding controls.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository provides a comprehensive exploit toolkit for CVE-2016-3714 (ImageMagick 'ImageTragick'). It contains two main exploit components: 1. 'imagick_builder.py' is a Python script that interactively generates malicious image files (MVG, SVG) designed to exploit vulnerable ImageMagick installations. It supports payloads for remote code execution, file read, file move, file delete, and SSRF. The script allows the user to specify commands, file paths, or URLs to embed in the payloads, and outputs the crafted images to an 'output/' directory. 2. 'imagick_bypass_shell.php' is a PHP web shell that leverages the Imagick extension to bypass PHP's disabled functions and execute system commands, read arbitrary files, or delete files on the server. It provides a web interface where attackers can supply parameters (cmd, read, del) to perform these actions. The shell works by generating and processing malicious image payloads on the fly using Imagick. The repository also includes a 'classes/colors.py' module for colored terminal output in the Python script, and a README.md with usage instructions and screenshots. The main attack vectors are network-based (uploading or processing malicious images via web applications) and local (abusing the Imagick extension on the server). Several fingerprintable endpoints are present, including example file paths and web shell URLs. The exploit is operational and provides both payload generation and a ready-to-use web shell for post-exploitation.
This repository provides a set of proof-of-concept (POC) exploits for CVE-2016-3714 (ImageTragick), targeting vulnerable ImageMagick installations. The exploit leverages the ability to embed shell commands within MVG and SVG image files, which are then executed by the server when processed by ImageMagick. The repository contains multiple payloads in different scripting languages (bash, nc, perl, php, python), each designed to establish a reverse shell or execute arbitrary commands on the target server. The structure is organized by payload type and includes both direct reverse shell payloads and command execution tests (e.g., using curl, wget, ping, telnet, nslookup). The README provides usage instructions, indicating that the attacker should set up a listener (e.g., with netcat) and upload the crafted image files to a vulnerable server. The endpoints used in the payloads are primarily localhost (127.0.0.1) for demonstration, but one payload targets an external IP (114.34.41.13). The repository is a comprehensive demonstration of the ImageTragick vulnerability and its exploitation via malicious image uploads.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A delegate command injection vulnerability in ImageMagick, commonly known as ImageTragick.
A prior ImageMagick remote code execution vulnerability, known as ImageTragick, referenced as historical context for security risks in ImageMagick coders.
A command injection vulnerability in ImageMagick (ImageTragick) where crafted image content (e.g., MVG directives) can be parsed and lead to arbitrary command execution during image processing, enabling outcomes like reverse shells.
A specific ImageMagick vulnerability, commonly known as ImageTragick, that can be triggered via malicious uploaded files and lead to server-side compromise.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.