MEDIUM 6.3 NuGet
ImageMagick has a Path Policy TOCTOU symlink race bypass
GHSA-493f-jh8w-qhx3 · CVE-2026-28689
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
domain="path" authorization is checked before final file open/use. A symlink swap between check-time and use-time bypasses policy-denied read/write.
Ready to move
Start Securing
Free, no credit card | First findings in minutes