CERT/CC warns ImageMagick policy gaps expose apps to SVG and PostScript file attacks

CERT/CC published advisory VU#580079 on 2026-11-12, describing a collection of issues it calls ImageTragick2 in applications that process attacker-controlled SVG or PostScript content under an insufficiently restrictive ImageMagick policy. The advisory treats the problem as a configuration issue, noting that upgrading ImageMagick alone may not close the exposure if the effective policy remains permissive. One variant abuses SVG references to invoke Magick Scripting Language resources that can read and write files, while another exploits content-based detection to route crafted files to Ghostscript, which may access shared temporary directories. Affected integrations include common web and content applications such as Ruby on Rails, WordPress, MediaWiki, ownCloud Classic and Redmine. Recommended mitigations include applying vendor updates, adopting allowlist policies, disabling unneeded coders and delegates, and isolating image processing with minimal filesystem access.