CVE-2016-3718
ImageMagick Server-Side Request Forgery (SSRF) Vulnerability
Published May 5, 2016 · updated Jun 16, 2026 · redhat enterprise linux desktop
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
Timeline
Detection, updates, and resolution for this record.
May 5, 2016 · Catalog
Detected
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
Required action
Apply updates per vendor instructions.
CISA due date May 3, 2022
Affected
- cpe canonical/ubuntu linux12.04
- cpe imagemagick/imagemagickversion unspecified
- cpe oracle/linux6
- cpe redhat/enterprise linux desktop6.0
- cpe redhat/enterprise linux desktop7.0
- cpe redhat/enterprise linux eus6.7
- cpe redhat/enterprise linux eus7.2
- cpe redhat/enterprise linux eus7.3
- cpe redhat/enterprise linux eus7.4
- cpe redhat/enterprise linux eus7.5
- cpe redhat/enterprise linux eus7.6
- cpe suse/linux enterprise debuginfo11
- vendor ImageMagick ImageMagickversion unspecified
Sources
- CISA KEVCVE-2016-3718
ImageMagick contains an unspecified vulnerability that allows attackers to perform server-side request forgery (SSRF) via a crafted image.
cisa.gov - CVE.orgCVE-2016-3718
Official CVE identifier
cve.org - FIRST EPSSCVE-2016-3718
30-day exploitation probability 75.6%
first.org - Exploit Database39767
Public archive entry. The exploit body is not stored here.
exploit-db.com - NIST NVDCVE-2016-3718
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
nvd.nist.gov