Low3.3Red Hat Linux

Low [CVE-2026-61859] Information disclosure via policy bypass in -script operation

This low-severity Red Hat Linux advisory covers CVE-2026-61859 affecting Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat package: imagemagick.

CVE-2026-61859 Published Jul 15, 2026Updated by vendor Jul 15, 2026

CVE-2026-61859

Affected products & platforms

Red Hat LinuxRed Hat Enterprise Linux

Open vendor advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

ImageMagick before 7.1.2-26 and 6.9.13-x before 6.9.13-51 contains a policy bypass vulnerability in the -script operation due to missing security policy checks. This allows reading files from paths that are otherwise disallowed by the configured security policy.

A flaw was found in ImageMagick. Red Hat Enterprise Linux ships ImageMagick in RHEL 6 ELS and RHEL 7 ELS.

This flaw has been rated as having a Low security impact and is not currently planned to be addressed in future updates of those products. For additional information, refer to the Issue Severity Classification:.

Red Hat severity: Low — CVSS 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-639.

Affected Red Hat products: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE.

Affected products named by the advisory: Red Hat package: imagemagick.

Affected versions

< 7.1.2-26
< 6.9.13-x
< 6.9.13-51
6.9.13

Official advisory · high-confidence parse· fetched 5 days ago·verify at source

Fixed versions

No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.

Official advisory · high-confidence parse· fetched 5 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation

Restrict use of the -script option by ensuring untrusted users cannot invoke ImageMagick commands directly. If ImageMagick is used in an automated pipeline, use a wrapper that does not pass the -script flag. Upgrade to ImageMagick 7.1.2-26 or 6.9.13-51 mitigates the issue.

Official advisory · high-confidence parse· fetched 5 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.