ImageMagick Server-Side Request Forgery (SSRF) Vulnerability
ImageMagick · ImageMagick
The ImageMagick HTTP and FTP coders, in versions before 6.9.3-10 and before 7.0.1-1, contain a server-side request forgery flaw that lets a crafted image make the server issue requests to URLs chosen by the attacker. Exploitation requires that a user process the malicious image, and the attacker needs no prior authentication.
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
- Exploited
- Yes, in CISA KEV
- Reports
- 0
- Tactics
- 1/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.What they do
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 5 years after disclosure. Public exploit code (Exploit-DB) was available 1 day before disclosure.
- Public exploit codeExploit-DB1 day before
- Disclosedday 0
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
1 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order, 2 cited passages 1Command and ControlTA0011
SSRF makes server issue attacker-chosen requests
allow remote attackers to conduct server-side request forgery (SSRF) attacks
Lower-confidence links (1)
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
- Exploit Public-Facing ApplicationT1190 needs user interaction; not a public-facing exploit
Detection
0 rules for this CVE · 22 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2016-3718 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
ProxyT109022 general rules
- Communication To LocaltoNet Tunneling Service Initiatedhightest
- Communication To LocaltoNet Tunneling Service Initiated - Linuxhightest
- Communication To Ngrok Tunneling Service - Linuxhightest
- Communication To Ngrok Tunneling Service Initiatedhightest
- HackTool - Htran/NATBypass Executionhightest
- Malicious IP Address Sign-In Failure Ratehightest
- Malicious IP Address Sign-In Suspicioushightest
- Ngrok Usage with Remote Desktop Servicehightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Not named in any threat report yetAlso mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
- Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
- 44 more on OTX