ImageMagick file read/write flaws dubbed ImageTragick2
New ImageMagick SVG and Ghostscript vulnerabilities let attackers read or write files, and potentially execute code, in apps like WordPress, Rails, and MediaWiki.
Sourcekb.cert.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT/CC has published VU#580079 describing two related vulnerability variants in ImageMagick, collectively called ImageTragick2, that allow arbitrary file read and write when the library processes attacker-controlled SVG or PostScript content under permissive security policies. Variant 1 abuses ImageMagick's SVG coder: a crafted <image> element's xlink:href can invoke the MSL: pseudo-protocol, causing ImageMagick to interpret attacker content as a Magick Scripting Language script that can redirect image data to arbitrary filesystem paths. Variant 2 relies on ImageMagick's content-based format detection misidentifying crafted input as PostScript and invoking Ghostscript, which—despite running with -dSAFER—still permits file access within /tmp, exposing shared temp storage used for uploads, sessions, or other sensitive artifacts.
Any application that lets ImageMagick process untrusted images (uploads, URLs, AI pipeline inputs/outputs) is potentially affected if its security policy does not restrict dangerous coders and delegates (MSL, MVG, PS, EPS, PDF). Named affected integrations include Ruby on Rails, WordPress, MediaWiki, ownCloud Classic, and Redmine; CERT/CC also flags increased exposure in containerized AI image-processing pipelines where images may come from automated agents, datasets, or model outputs and where writable host mounts or shared volumes can escalate impact. In some configurations, file read/write can be chained to achieve arbitrary code execution. A specific WordPress instance of Variant 2 has been assigned CVE-2026-65640, independently discovered by the pwn.ai team; Variant 1/overall issues were reported by RyotaK of GMO Flatt Security. There is no indication of in-the-wild exploitation at time of publication.
CERT/CC stresses that ImageMagick treats policy-restrictable behavior as a configuration responsibility rather than a core vulnerability, meaning updating ImageMagick alone may not remediate exposure. Defenders should deploy an allowlist-based policy.xml disabling unneeded coders/delegates (MSL, MVG, PS, EPS, PDF), verify the effective policy actually rejects prohibited formats, isolate image processing in minimally privileged environments (including AI pre/post-processing stages), validate file content rather than trusting extensions or MIME types, and monitor for policy violations, unexpected coder/delegate invocation, and unusual file creation.
Mentioned in this report
Detection guidance
ImageMagick Invoked With MSL Pseudo-Protocol
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects ImageMagick binaries launched with the msl: pseudo-protocol, the ImageTragick2 Variant 1 primitive for arbitrary file write via Magick Scripting Language. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ImageMagick Invoked With MSL Pseudo-Protocol
description: 'Detects ImageMagick command-line tools invoked with an msl: pseudo-protocol
argument. Abused in ImageTragick2 (VU#580079) Variant 1 to run attacker-controlled
Magick Scripting Language that writes image data to arbitrary paths.'
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_img:
Image|endswith:
- /convert
- /magick
- /identify
- /mogrify
- /montage
- /composite
- /convert-im6.q16
- /convert-im7.q16
selection_msl:
CommandLine|contains: 'msl:'
condition: selection_img and selection_msl
falsepositives:
- Administrators or developers intentionally running MSL scripts through ImageMagick
level: high
id: 879e0db1-e7c7-544c-b25a-baa580ec8025
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/580079
Ghostscript Spawned by ImageMagick With SAFER Flag
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Hunting rule for Ghostscript started by ImageMagick delegates with -dSAFER, the ImageTragick2 Variant 2 path where content-sniffed input is handed to Ghostscript. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Ghostscript Spawned by ImageMagick With SAFER Flag
description: Detects Ghostscript launched by an ImageMagick tool with -dSAFER. ImageTragick2
(VU#580079) Variant 2 tricks format detection into treating crafted input as PostScript,
which still permits file access under /tmp. Hunting rule that needs context, as
legitimate PDF/EPS conversions use the same delegate.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /convert
- /magick
- /identify
- /mogrify
- /convert-im6.q16
- /convert-im7.q16
Image|endswith:
- /gs
- /ghostscript
CommandLine|contains: -dSAFER
condition: selection
falsepositives:
- Legitimate PDF, EPS or PostScript thumbnailing by web applications such as WordPress
or MediaWiki
- Document conversion pipelines that rasterise PDFs through ImageMagick
level: low
id: 778e95d7-167e-5817-bbfa-739ac5aa3763
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/580079
MSL Pseudo-Protocol in Web Request Query
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects web requests whose query string references the msl: coder, indicating attempts to feed ImageMagick an MSL script via a URL or filename parameter. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: MSL Pseudo-Protocol in Web Request Query
description: 'Detects web requests carrying the ImageMagick msl: pseudo-protocol in
the query string, for example an image URL or path parameter, consistent with ImageTragick2
Variant 1 exploitation attempts.'
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- 'msl:'
- msl%3a
condition: selection
falsepositives:
- Security scanners or penetration tests probing for ImageMagick coder abuse
level: medium
id: 929b7fdd-9e18-5877-956c-3eea321a8741
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/580079
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/580079
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs