GHSA-v3j6-27vc-7pw2: ImageMagick: Policy Bypass in APNG encoder and delegates due to a missing check

July 24, 2026

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

References

github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v3j6-27vc-7pw2
github.com/advisories/GHSA-v3j6-27vc-7pw2
github.com/dlemstra/Magick.NET/releases/tag/14.15.0

Code Behaviors & Features

Detect and mitigate GHSA-v3j6-27vc-7pw2 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →