Signals
Back to database
Track22Medium4.0VulnerabilityCVE-2026-106566No patch link observed

CVE-2026-106566 — ImageMagick is free and open-source software used for editing and manipulating digital images.

Published Oct 7, 2026, 04:17 PM UTCIngested 1d agoSource NVD(cve-db)CVE-2026-106566

Description

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment variable, allowing a local privileged workflow to overwrite a file with random data. This issue is fixed in version 7.1.2-32.

CVSS v3.1 base metrics

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N
4.0

Medium severity

Band computed from the CVSS base score, not the source's own label — so it means the same thing across every feed.

AV

Local

Attack Vector

AC

High

Attack Complexity

PR

High

Privileges Required

UI

Required

User Interaction

S

Unchanged

Scope

C

None

Confidentiality

I

High

Integrity

A

None

Availability

References

Related threats

same CWE or vendor
Medium

CVE-2026-107174 — A flaw was found in source-to-image.

CVE-2026-107174 · 1d ago

High

CVE-2026-103435 — Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at wr…

CVE-2026-103435 · 1d ago

Medium

CVE-2026-106507 — Backstage is an open framework for building developer portals.

CVE-2026-106507 · 2d ago

Low

CVE-2026-105712 — gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive.

CVE-2026-105712 · 3d ago

High

Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections

OSV · 6d ago

High

CVE-2026-97024 — A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certa…

CVE-2026-97024 · 10d ago