GHSA-v3j6-27vc-7pw2: ImageMagick: Policy Bypass in APNG encoder and delegates due to a missing check

July 24, 2026

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

References

github.com/ImageMagick/ImageMagick/security/advisories/GHSA-v3j6-27vc-7pw2
github.com/advisories/GHSA-v3j6-27vc-7pw2
github.com/dlemstra/Magick.NET/releases/tag/14.15.0

Code Behaviors & Features

Detect and mitigate GHSA-v3j6-27vc-7pw2 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →