ACTIVELY EXPLOITED
CVE-2016-3715: ImageMagick Arbitrary File Deletion Vulnerability
| Vendor | ImageMagick |
|---|---|
| Product | ImageMagick |
| Actively exploited | Yes |
| Added to CISA KEV | 3 Nov 2021 |
| CISA federal deadline | 3 May 2022 |
| Weakness (CWE) | CWE-284 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
ImageMagick contains an unspecified vulnerability that could allow users to delete files by using ImageMagick's 'ephemeral' pseudo protocol, which deletes files after reading.
SOURCES
Other ImageMagick flaws
- CVE-2016-3714: ImageMagick Improper Input Validation Vulnerability
- CVE-2016-3718: ImageMagick Server-Side Request Forgery (SSRF) Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.