ImageMagick, a widely used open‑source image manipulation library, contains a flaw in its filename parsing logic that allows an attacker to evade the library's security policy through the use of a symbolic link. This policy bypass can grant read access to files that should be prohibited, leading to information disclosure. The weakness maps to CWE‑200 (Information Exposure), CWE‑22 (Path Traversal), and other related weaknesses such as CWE‑78 and CWE‑863 cited by the CNA.

The vulnerability affects all installations of ImageMagick prior to versions 6.9.13‑48 and 7.1.2‑24. Any system that relies on these older releases and processes images supplied by untrusted users is potentially impacted.

The CVSS score of 5.5 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves supplying a specially crafted filename or symbolic link that triggers the misparsed policy enforcement. Successful exploitation requires the application to invoke ImageMagick’s processing routines on the supplied input, so systems that restrict image handling or validate filenames before processing may inherently mitigate the risk.