ImageTragick2: apps using ImageMagick can read or write files
Original title: VU#580079: Arbitrary file read/write vulnerability in ImageMagick-based applications with default configuration
Crafted SVG or PostScript can invoke MSL or Ghostscript when policy allows those coders; Kiteworks reports no known exploitation.
CERT/CC VU#580079 describes ImageTragick2, arbitrary file read and write in applications that process untrusted images with ImageMagick under default or weak security policies. A crafted SVG can invoke a Magick Scripting Language coder, and content detection can send input to Ghostscript, which in the observed setup can access /tmp despite -dSAFER. File access may be chained to code execution. Rails, WordPress, MediaWiki, ownCloud Classic, Redmine, and AI image pipelines are named as typical users. Kiteworks says ownCloud Classic and its platform are affected and fixes are in progress.
Unconfirmed: Only Kiteworks states it has no indication of exploitation; other vendors’ fix and exploitation status are not given.
- Variant 2 was also reported to WordPress as CVE-2026-65640 by the pwn.ai team.
- RyotaK of GMO Flatt Security reported the issues; vendors were notified August 26, 2026.
- CERT says ImageMagick treats restrictable behavior as configuration, not its own vulnerability.
- Recommended disables include MSL, MVG, PS, EPS, and PDF coders or delegates.
- Kiteworks says it has no indication of exploitation.
Impact: Read or write files reachable by ImageMagick; possible code execution
| Product | Affected |
|---|---|
| ImageMagick | — |
| Kiteworks ownCloud Classic | — |
| Kiteworks | — |
- 1.Install vendor updates for ImageMagick integrations, including ownCloud Classic and Kiteworks, when available.
- 2.Apply an allowlist policy.xml and disable unneeded MSL, MVG, PS, EPS, and PDF coders.
- 3.Process untrusted images in a minimally privileged environment with restricted filesystem access.
- CVEs
- CVE-2026-65640
- Vendors
- ImageMagickKiteworks
- Organizations
- CERT/CCGMO Flatt Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-65640 | Author-Level RCE in WordPress Core via Malicious Postscript File Upload | 8.8 | 2% |
From the original article
5 min read at kb.cert.orgOverview Multiple arbitrary file read and write vulnerabilities have been identified in applications that use ImageMagick with insufficiently restrictive security policies. Collectively referred to as ImageTragick2, these issues arise when ImageMagick processes attacker-controlled SVG or PostScript content using dangerous coders or delegates permitted by its default or application-supplied configuration.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.