# ImageMagick file read/write flaws dubbed ImageTragick2

Published: 2026-11-12 · Severity: routine · Sectors: Technology
Canonical: https://vorant.io/reports/83755790-dd4e-5b8e-984e-670a4d5fa8c3/imagemagick-file-read-write-flaws-dubbed-imagetragick2
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> New ImageMagick SVG and Ghostscript vulnerabilities let attackers read or write files, and potentially execute code, in apps like WordPress, Rails, and MediaWiki.

Source: kb.cert.org — https://kb.cert.org/vuls/id/580079

## What to check

- Applies to: The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT/CC has published VU#580079 describing two related vulnerability variants in ImageMagick, collectively called ImageTragick2, that allow arbitrary file read and write when the library processes attacker-controlled SVG or PostScript content under permissive security policies. Variant 1 abuses ImageMagick's SVG coder: a crafted <image> element's xlink:href can invoke the MSL: pseudo-protocol, causing ImageMagick to interpret attacker content as a Magick Scripting Language script that can redirect image data to arbitrary filesystem paths. Variant 2 relies on ImageMagick's content-based format detection misidentifying crafted input as PostScript and invoking Ghostscript, which—despite running with -dSAFER—still permits file access within /tmp, exposing shared temp storage used for uploads, sessions, or other sensitive artifacts.

Any application that lets ImageMagick process untrusted images (uploads, URLs, AI pipeline inputs/outputs) is potentially affected if its security policy does not restrict dangerous coders and delegates (MSL, MVG, PS, EPS, PDF). Named affected integrations include Ruby on Rails, WordPress, MediaWiki, ownCloud Classic, and Redmine; CERT/CC also flags increased exposure in containerized AI image-processing pipelines where images may come from automated agents, datasets, or model outputs and where writable host mounts or shared volumes can escalate impact. In some configurations, file read/write can be chained to achieve arbitrary code execution. A specific WordPress instance of Variant 2 has been assigned CVE-2026-65640, independently discovered by the pwn.ai team; Variant 1/overall issues were reported by RyotaK of GMO Flatt Security. There is no indication of in-the-wild exploitation at time of publication.

CERT/CC stresses that ImageMagick treats policy-restrictable behavior as a configuration responsibility rather than a core vulnerability, meaning updating ImageMagick alone may not remediate exposure. Defenders should deploy an allowlist-based policy.xml disabling unneeded coders/delegates (MSL, MVG, PS, EPS, PDF), verify the effective policy actually rejects prohibited formats, isolate image processing in minimally privileged environments (including AI pre/post-processing stages), validate file content rather than trusting extensions or MIME types, and monitor for policy violations, unexpected coder/delegate invocation, and unusual file creation.

## Mentioned in this report

- Vulnerabilities: CVE-2026-65640
- Campaigns: ImageTragick2

## Detection guidance (public sample)

### ImageMagick Invoked With MSL Pseudo-Protocol

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs linux process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Detects ImageMagick binaries launched with the msl: pseudo-protocol, the ImageTragick2 Variant 1 primitive for arbitrary file write via Magick Scripting Language. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ImageMagick Invoked With MSL Pseudo-Protocol
description: 'Detects ImageMagick command-line tools invoked with an msl: pseudo-protocol
  argument. Abused in ImageTragick2 (VU#580079) Variant 1 to run attacker-controlled
  Magick Scripting Language that writes image data to arbitrary paths.'
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
    - /convert
    - /magick
    - /identify
    - /mogrify
    - /montage
    - /composite
    - /convert-im6.q16
    - /convert-im7.q16
  selection_msl:
    CommandLine|contains: 'msl:'
  condition: selection_img and selection_msl
falsepositives:
- Administrators or developers intentionally running MSL scripts through ImageMagick
level: high
id: 879e0db1-e7c7-544c-b25a-baa580ec8025
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/580079
```

### Ghostscript Spawned by ImageMagick With SAFER Flag

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs linux process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

Hunting rule for Ghostscript started by ImageMagick delegates with -dSAFER, the ImageTragick2 Variant 2 path where content-sniffed input is handed to Ghostscript. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Ghostscript Spawned by ImageMagick With SAFER Flag
description: Detects Ghostscript launched by an ImageMagick tool with -dSAFER. ImageTragick2
  (VU#580079) Variant 2 tricks format detection into treating crafted input as PostScript,
  which still permits file access under /tmp. Hunting rule that needs context, as
  legitimate PDF/EPS conversions use the same delegate.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /convert
    - /magick
    - /identify
    - /mogrify
    - /convert-im6.q16
    - /convert-im7.q16
    Image|endswith:
    - /gs
    - /ghostscript
    CommandLine|contains: -dSAFER
  condition: selection
falsepositives:
- Legitimate PDF, EPS or PostScript thumbnailing by web applications such as WordPress
  or MediaWiki
- Document conversion pipelines that rasterise PDFs through ImageMagick
level: low
id: 778e95d7-167e-5817-bbfa-739ac5aa3763
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/580079
```

### MSL Pseudo-Protocol in Web Request Query

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs webserver logs. Status: experimental. Generated from the report; not run against telemetry.

Detects web requests whose query string references the msl: coder, indicating attempts to feed ImageMagick an MSL script via a URL or filename parameter. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: MSL Pseudo-Protocol in Web Request Query
description: 'Detects web requests carrying the ImageMagick msl: pseudo-protocol in
  the query string, for example an image URL or path parameter, consistent with ImageTragick2
  Variant 1 exploitation attempts.'
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:
    - 'msl:'
    - msl%3a
  condition: selection
falsepositives:
- Security scanners or penetration tests probing for ImageMagick coder abuse
level: medium
id: 929b7fdd-9e18-5877-956c-3eea321a8741
status: experimental
author: Vorant
references:
- https://kb.cert.org/vuls/id/580079
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/580079

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/83755790-dd4e-5b8e-984e-670a4d5fa8c3/imagemagick-file-read-write-flaws-dubbed-imagetragick2.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup