ImageTragick is the name for five ImageMagick vulnerabilities, CVE-2016-3714 through CVE-2016-3718, that come from a lack of sanitization of untrusted input. CVE-2016-3714 allows remote code execution because ImageMagick does not filter file names passed to delegate commands well enough. CVE-2016-3718 allows server-side request forgery. CVE-2016-3715 lets an attacker delete local files, CVE-2016-3716 move them, and CVE-2016-3717 read them. CERT/CC lists a policy file that disables the vulnerable ImageMagick coders as a mitigation.
Updated
| CVE | Title | Vendor | CVSS | EPSS | KEV | Published |
|---|---|---|---|---|---|---|
| CVE-2016-3714KEV ImageMagick Improper Input Validation Vulnerability | ImageMagick Improper Input Validation Vulnerability | - | 8.4 | 97.5% | KEV | 2016-05-05 |
| CVE-2016-3718KEV ImageMagick Server-Side Request Forgery (SSRF) Vulnerability | ImageMagick Server-Side Request Forgery (SSRF) Vulnerability | - | 5.5 | 75.6% | KEV | 2016-05-05 |
| CVE-2016-3715KEV ImageMagick Arbitrary File Deletion Vulnerability | ImageMagick Arbitrary File Deletion Vulnerability | - | 5.5 | 75.3% | KEV | 2016-05-05 |
CVE-2016-3716 and CVE-2016-3717 are part of ImageTragick but have no record in this database.
ImageMagick Improper Input Validation Vulnerability
Part of ImageTragick, a set of ImageMagick flaws credited to Nikolay Ermishkin of the Mail.Ru Security Team and Stewie; this CVE allows code execution because file names passed to delegate commands are not filtered enough. CERT/CC recommends a policy file that disables the vulnerable ImageMagick coders.
ImageMagick Arbitrary File Deletion Vulnerability
Part of ImageTragick, a set of ImageMagick flaws credited to Nikolay Ermishkin of the Mail.Ru Security Team and Stewie; this CVE lets crafted image input delete local files. Debian's advisory traces the set to a lack of sanitization of untrusted input.
ImageMagick Server-Side Request Forgery (SSRF) Vulnerability
Part of ImageTragick, a set of ImageMagick flaws credited to Nikolay Ermishkin of the Mail.Ru Security Team and Stewie; this CVE is the server-side request forgery flaw, which lets crafted image input make HTTP GET or FTP requests. Debian's advisory traces the set to a lack of sanitization of untrusted input.
| CVE | Added | Due | Ransomware |
|---|---|---|---|
| CVE-2016-3714 | 2024-09-09 | 2024-09-30 | - |
| CVE-2016-3715 | 2021-11-03 | 2022-05-03 | - |
| CVE-2016-3718 | 2021-11-03 | 2022-05-03 | - |
ImageTragick is the name for five ImageMagick vulnerabilities, CVE-2016-3714 through CVE-2016-3718, that come from a lack of sanitization of untrusted input. CVE-2016-3714 allows remote code execution because ImageMagick does not filter file names passed to delegate commands well enough. CVE-2016-3718 allows server-side request forgery. CVE-2016-3715 lets an attacker delete local files, CVE-2016-3716 move them, and CVE-2016-3717 read them. CERT/CC lists a policy file that disables the vulnerable ImageMagick coders as a mitigation.
ImageTragick covers five CVEs: CVE-2016-3714, CVE-2016-3715, CVE-2016-3716, CVE-2016-3717, and CVE-2016-3718. CVE-2016-3716 and CVE-2016-3717 are part of ImageTragick but have no record in this database.
3 of the 5 ImageTragick CVEs are in the CISA Known Exploited Vulnerabilities catalog as of 2026-11-03: CVE-2016-3714 (added 2024-09-09), CVE-2016-3715 (added 2021-11-03), and CVE-2016-3718 (added 2021-11-03).
The highest CVSS base score among the ImageTragick CVEs is 8.4 (HIGH), for CVE-2016-3714.
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). Alert titles and links from CISA cybersecurity alerts. This site is not affiliated with or endorsed by MITRE, NVD, CISA, or FIRST.