ImageMagick implements path-based security with policy rules such as /etc/* to deny access to sensitive files. Prior to 7.1.2-15 and 6.9.13-40, the policy matcher examines the unnormalized filename before the operating system resolves it. A malicious user can embed a path traversal sequence in the raw filename; ImageMagick will bypass the policy check, the OS will resolve the traversal, and the file is opened, allowing the attacker to read arbitrary local files. This flaw (CWE-22) provides local file disclosure, compromising confidentiality of any file reachable by the system.

The vulnerability affects all ImageMagick installations before version 7.1.2-15 and 6.9.13-40. Systems running those earlier releases are at risk, regardless of the presence or strength of policy-secure.xml, because the bypass occurs before the policy is applied.

The CVSS score of 8.6 reflects a high severity. The EPSS score is lower than 1%, indicating a very small probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Likely exploitation requires local access to a process that runs ImageMagick on crafted image data; an attacker could trigger the read by providing a specially crafted image file or by compromising a user that processes untrusted images.