ImageMagick's policy bypass through path traversal allows reading restricted content despite secured policy

Vulnerability

Details

ImageMagick's path security policy, defined in policy-secure.xml, is intended to restrict file access by pattern matching on file paths. However, prior to versions 7.1.2-15 and 6.9.13-40, the policy is evaluated on the raw, unnormalized filename string before the operating system resolves any path traversal components [2][4]. This means a rule like /etc/* will not match a path such as /etc/../etc/passwd because the policy matcher sees the literal string with .. rather than the canonical path.

Exploitation

An attacker who can supply a filename to ImageMagick (e.g., via a web application that processes user-uploaded images) can craft a path that includes traversal sequences like ../. The OS resolves these sequences and opens the intended sensitive file, but the policy check only sees the unnormalized path and incorrectly allows the operation [2]. No authentication is required beyond the ability to invoke ImageMagick with a controlled filename.

Impact

Successful exploitation leads to local file disclosure (LFD), allowing an attacker to read arbitrary files on the system that the ImageMagick process has access to, such as /etc/passwd or application configuration files. This bypasses the security policy even when it is explicitly configured to block access to sensitive directories [4].

Mitigation

The issue is fixed in ImageMagick versions 7.1.2-15 and 6.9.13-40 [2][3]. Additionally, administrators are advised to add a policy rule `` to prevent path traversal patterns from being accepted. This rule will be included by default in future secure policies [4].