A path traversal vulnerability in ImageMagick allows unauthenticated attackers to bypass security policies and access sensitive local files on the host system.

This vulnerability occurs because ImageMagick evaluates security policy rules against raw, unnormalized path strings before filesystem resolution. An unauthenticated attacker can supply a crafted path traversal sequence to circumvent restrictions, enabling the unauthorized reading of sensitive files despite existing security configurations.

The ability for an unauthenticated attacker to read arbitrary files from the filesystem presents a severe risk to data confidentiality. With a CVSS score of 8.6, this vulnerability is classified as High severity, as it can lead to the exposure of credentials, configuration files, or other sensitive system data, potentially facilitating further system compromise.

Immediate Action: Update ImageMagick to version 7.1.2-15 or 6.9.13-40, or apply the latest patches provided by your package maintainer or the vendor. For Magick.NET users, ensure the library is updated to version 14.10.3.

Proactive Monitoring: Review application access logs for unusual file access patterns or strings containing directory traversal sequences, such as multiple dot-dot-slash patterns.

Compensating Controls: Ensure that the policy.xml file is configured to restrict read and write access to sensitive directories, and consider isolating image processing tasks within a restricted container or sandboxed environment to limit filesystem visibility.

Public Exploit Available: Unknown

Given the potential for unauthorized local file disclosure and the high CVSS severity, organizations should prioritize patching ImageMagick installations. If immediate updates are not feasible, verify that your security policies are as restrictive as possible and monitor for suspicious traversal patterns in your application traffic to detect potential exploitation attempts.