Medium [CVE-2026-55628] Unauthorized file access due to missing policy checks in concatenate operation
This medium-severity Red Hat Linux advisory covers CVE-2026-55628 affecting Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat package: imagemagick.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
In versions prior to 7.1.2-26he, the `-concatenate` operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy. This issue has been fixed in version 7.1.2-26.
A flaw was found in ImageMagick. The `-concatenate` operation, used for combining images, lacks proper security policy checks.
This oversight could allow an attacker to read from or write to file paths that should otherwise be restricted by the security policy. This could lead to unauthorized access to sensitive system resources.
Red Hat severity: Moderate — CVSS 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). Weakness: CWE-1220.
Affected Red Hat products: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7.
Red Hat does not currently list a fixing RHSA for this CVE.
Affected products named by the advisory: Red Hat package: imagemagick.
- < 7.1.2-26he
- 7.1.2
Official advisory · high-confidence parse· fetched 14 days ago·verify at source
- 7.1.2-26
Official advisory · high-confidence parse· fetched 14 days ago·verify at source
Mitigation checklist
- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Official advisory · high-confidence parse· fetched 14 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.