ZeroDay Findings
Sign inSign up

Findings

CVE-2016-3718

ImageMagick Server-Side Request Forgery (SSRF) Vulnerability

Published May 5, 2016 · updated Jun 16, 2026 · redhat enterprise linux desktop

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. May 5, 2016 · Catalog

    Detected

    The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. May 3, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.

Required action

Apply updates per vendor instructions.

CISA due date May 3, 2022

Affected

  • cpe canonical/ubuntu linux12.04
  • cpe imagemagick/imagemagickversion unspecified
  • cpe oracle/linux6
  • cpe redhat/enterprise linux desktop6.0
  • cpe redhat/enterprise linux desktop7.0
  • cpe redhat/enterprise linux eus6.7
  • cpe redhat/enterprise linux eus7.2
  • cpe redhat/enterprise linux eus7.3
  • cpe redhat/enterprise linux eus7.4
  • cpe redhat/enterprise linux eus7.5
  • cpe redhat/enterprise linux eus7.6
  • cpe suse/linux enterprise debuginfo11
  • vendor ImageMagick ImageMagickversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2016-3718

    ImageMagick contains an unspecified vulnerability that allows attackers to perform server-side request forgery (SSRF) via a crafted image.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2016-3718

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2016-3718

    30-day exploitation probability 75.6%

    first.org
  • Exploit DatabasePublic exploit reference39767

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • NIST NVDVulnerability recordCVE-2016-3718

    The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.

    nvd.nist.gov

References