CyberRota Analysis
AI-GeneratedImageMagick versions prior to 7.1.2-30 and 6.9.13-55 are vulnerable to a time-of-check-time-of-use (TOCTOU) flaw in the video decoder, enabling attackers to exploit symlink swaps to bypass path policy write restrictions. This vulnerability allows unauthorized writing to locations that should be restricted by policy. Organizations using affected versions of ImageMagick should prioritize patching to mitigate potential risks associated with unauthorized file access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy validation (check-time) and the file write operation (use-time) to write to policy-denied locations.
Related CVEs
Other vulnerabilities affecting the same vendor(s)