CVE-2026-25965

ImageMagick (affected: prior to 7.1.2-15 and 6.9.13-40): path security policy is evaluated on the raw filename before filesystem resolution, allowing a path traversal to bypass rules like /etc/* and read restricted files. The OS resolves the traversal, but the policy matcher sees the unnormalized...