CVE-2026-61858

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>ImageMagick6</name>
	<range><lt>6.9.13-51</lt></range>
      </package>
      <package>
	<name>ImageMagick6-nox11</name>
	<range><lt>6.9.13-51</lt></range>
      </package>
      <package>
	<name>ImageMagick7</name>
	<range><lt>6.9.13-51</lt></range>
      </package>
      <package>
	<name>ImageMagick7-nox11</name>
	<range><lt>6.9.13-51</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in
	the APNG encoder and external delegates due to missing validation
	checks. Attackers can write files to disallowed paths by bypassing
	configured policy restrictions through the APNG encoding process.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-61858</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-61858</url>
    </references>
    <dates>
      <discovery>2026-07-11</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>