Re: [oS-EN] Image magick refuses to convert a true jpg file

16.06.2026 15:14, Simon Lees wrote:
...

>>
>> Should I open a bug report?
>>
>> I am using the default policy of Leap 16.0
> 
> I believe this is the intended behavior, imagemagick in Leap comes from
> SLES where having a very safe policy by default and allowing admins to
> open it up as needed is most certainly the desired behavior.
> 

The default SUSE policy includes

<policy domain="path" rights="none" pattern="*../*"/>

After ImageMagick-CVE-2026-25965.patch ImageMagick applies policy check 
to the result of the realpath() which eliminates /../. So, this 
condition actually looks redundant and blocks legitimate paths.

Besides, in the OP example there is *no* possible illegal traversal 
because filenames that ImageMagick opens do *not* contain any ../ 
characters and ImageMagick opens them as openat(AT_FDCWD, ...).

If it is the desired behavior, I wonder what should happen to be 
designated as a bug.