ImageTragick2: Arbitrary File Read and Write in ImageMagick via SVG and PostScript Processing

1. Basic Information

• Article Title: Arbitrary file read/write vulnerability in ImageMagick-based applications with default configuration
• Publisher: CERT/CC
• Publication Date: 2026-11-12
• Updated Date: 2026-11-12
• Collection Date: 2026-11-14T08:00:43+09:00
• Source: CERT/CC
• Related Information Sources: JVN: Arbitrary File Read/Write in ImageMagick, Rails Official Advisory (Active Storage)
• Related Malware: None
• Related Threat Groups: None
• Related CVEs: CVE-2026-65640 (Variant 2 report for WordPress, format detection to Ghostscript path), CVE-2026-126082 (Rails official advisory). Neither is a common CVE for ImageMagick as a whole.
• Related Products and Technologies: ImageMagick, Ghostscript, MSL, SVG, PostScript
• Response Priority (Author's Assessment): High
• Priority Rationale: Processing untrusted images in web applications, CMS platforms, or AI image pipelines may expose server files and, depending on the configuration, lead to code execution. The public materials reviewed do not provide specific examples of real-world exploitation.

2. Summary

CERT/CC reported two issues: crafted SVG files can invoke the MSL coder path to read or write files accessible to the ImageMagick process, while crafted PostScript content can trigger format detection that invokes Ghostscript, allowing file access within /tmp in the observed configuration.

3. Attack Flow

SVG to MSL Path

1. An attacker uploads a crafted SVG file.
2. ImageMagick processes the file with the internal SVG coder and necessary dangerous coders available, selecting the MSL coder path.
3. It reads or writes files accessible to the ImageMagick process via MSL.
4. If the write destination is an executable or configuration path, it can chain into subsequent remote code execution.

Format Detection to Ghostscript Path

1. An attacker uploads crafted PostScript content (regardless of file extension).
2. ImageMagick selects Ghostscript processing through format detection, and Ghostscript launches with -dSAFER.
3. Under observed configurations, files within /tmp can be read and written.
4. Writing to executable or configuration paths outside of /tmp has not been confirmed in observed configurations, and additional conditions are required to chain into remote code execution.

4. Attacker Position and Execution Location

• A remote attacker who can reach the image upload or conversion API.

5. Victim and Administrator Perspective

Victim Side

• May appear as image conversion failures, unexpected output, or service anomalies.

Administrator Side

• May appear as ImageMagick or Ghostscript child processes, unusual file read and write activities, or web root modifications (this is an analytical inference derived from configurations and is not a trace observed in actual incidents).

6. Success and Failure Conditions

Success Conditions

• Untrusted images are passed to ImageMagick.
• Dangerous coders are allowed by the policy (for the SVG path, the internal SVG coder and necessary dangerous coders must be available).
• The process can access sensitive files or write destinations (for the PostScript path, this is limited to /tmp in observed configurations).

Failure Conditions and Countermeasures

• Allow-list only necessary coders and disable MSL, MVG, PS, EPS, and PDF (a prevention measure by rejecting coders and delegates).

7. What Happens Upon Success

• Reading of sensitive files (within the scope accessible to the ImageMagick process for the SVG path, and limited to /tmp in observed configurations for the PostScript path).
• Modification of configuration and application files (limited to configurations where the write destination reaches execution or configuration paths).
• Conditional remote code execution.

8. Observable Logs

• email: None noted
• Proxy / SWG / DNS: Uploads containing SVG or PostScript content (requires conditions where the proxy can inspect the body, such as TLS decryption; DNS logs alone cannot reveal upload contents).
• Endpoint / EDR: convert, magick, or gs processes and file access to sensitive paths (depends on the presence of file access auditing).
• Identity / IdP: None noted
• SaaS / Cloud: None noted
• network: Crafted uploads to the image conversion API.

9. Attack Success Determination

SVG to MSL Path: File Access Reported; Who Validated It and in What Environment Remain Unconfirmed

• Public Information: CERT/CC reported that crafted SVG files allow the ImageMagick process to read and write accessible files through the MSL coder path.
• Confirmation Scope: This assessment is limited to the reported behavior. The public text does not establish who validated it or in what environment, and the available public materials do not establish whether real-world exploitation has occurred. Reported file access should be distinguished from confirmed arbitrary code execution.

Format Detection to Ghostscript Path: File Access Within /tmp Reported; Who Validated It and in What Environment Remain Unconfirmed

• Public Information: CERT/CC reported that crafted PostScript content is selected for Ghostscript processing via format detection, and under observed configurations, Ghostscript running with -dSAFER accesses files within /tmp.
• Confirmation Scope: This assessment is limited to the reported behavior. The public text does not establish who validated it or in what environment, and the available public materials do not establish whether real-world exploitation has occurred. Reported file access should be distinguished from confirmed arbitrary code execution.

The fixed label "Initial Execution Confirmed" is an evaluation perspective and does not represent verified facts regarding verification entities or environments.

10. Investigation Playbook

• trigger: Abnormal file access by ImageMagick processes, Ghostscript startup, unexpected writes.
• Initial Checks: Verify target versions, policy.xml, enabled coders, and service privileges.
• endpoint: Preserve process trees, input samples, filesystem diffs, and container layers.
• Identity / Cloud: Evaluate service credentials and the exposure of readable secrets.
• Follow-on Activity: Trace writes to web roots, cron jobs, plugins, and model pipelines.
• containment: Stop services, disable dangerous coders, rebuild containers, and rotate secrets.
• classification: Differentiate between upload only, file read, file write, and code execution.

11. Defense and Detection Ideas

• Single-Event Detection: Access to /etc, credentials, or web roots from image processing.
• Time-Series Correlation: Correlate uploads -> magick/gs -> file writes -> web process execution.
• hunting: Search for past SVG or PostScript uploads and image service file events.
• Logging Gaps: If file access outside the container is not audited, reproduction testing and hash comparisons are required.
• Priority Controls: Prioritize coder allow-lists, sandboxing, and read-only filesystems. Processing in dedicated low-privilege containers reduces the blast radius (file access itself can still occur if readable files or writable shared areas remain). Magic byte and format validation of upload contents serve as auxiliary measures performed in safe processing pathways before dangerous decoding logic (re-validation after decoding alone cannot prevent access during processing, so it is not a standalone failure condition).

12. Facts, Inference, and Hypothesis

Facts

• Crafted SVG files can read and write files accessible to the ImageMagick process via the MSL coder path.
• ImageMagick may identify crafted content as PostScript and invoke Ghostscript regardless of the file extension.
• In the PostScript path, Ghostscript launches with -dSAFER, and access is limited to /tmp in observed configurations.
• Configurations where arbitrary file writes reach application code or settings may chain to RCE. In the PostScript path alone, writes to execution or configuration paths outside of /tmp have not been confirmed within observed configurations.
• Updates alone may not be sufficient; explicit allow-listing in policy.xml and disabling unnecessary coders are recommended.
• Public materials reviewed do not show specific examples of active exploitation. Kiteworks' statement explains the scope of its own products.
• CVE-2026-65640 is a Variant 2 report for WordPress (format detection to Ghostscript path), and CVE-2026-126082 is an issue in Rails (Active Storage); neither is a common CVE for ImageMagick as a whole.

Inference

• AI image workflows, like web uploads, can serve as an entry point for server compromise if untrusted images are passed to high-privilege processes.

Hypothesis

• No additional hypotheses

13. MITRE ATT&CK Mapping

No specific MITRE ATT&CK mapping is provided in the source report.

14. Unknowns and Further Investigation

• The full range of affected versions, individual distribution patches, and success conditions for RCE in real environments require individual verification.

15. Impact on SOCs and Organizations

Inventory CMS platforms, document converters, and generative AI workflows that integrate ImageMagick, and restrict MSL, MVG, PS, EPS, and PDF to the minimum necessary.

16. Summary by Persona

• For SOCs: Monitor image processing processes for access to configuration files, credentials, and web roots, and monitor Ghostscript child processes.
• For Administrators: Apply policy.xml allow-lists, disable unnecessary coders, implement container isolation, and use read-only filesystems.
• For Users: Verify the reliability of externally sourced images when feeding them into internal conversion services.