Intel

CVE-2016-3715

ImageMagick ImageMagick — ImageMagick Arbitrary File Deletion Vulnerability

criticalKEV: actively exploitedPoCEPSS 75%

Description

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.

Source: CISA_KEVCVEORGCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2016-3715 is part of the "ImageTragick" cluster (CVE-2016-3714 through -3718) and remains on the CISA KEV list because unpatched deployments of ImageMagick continue to be targeted despite the vulnerability's age — the EPSS score of 75.38 % at the 99.5th percentile reflects sustained, real-world exploitation probability. The vulnerability enables arbitrary file deletion under the privileges of the web application process, which can destroy configuration files, session stores, or deployment artifacts and create conditions for follow-on attacks such as privilege escalation after deleting .htaccess or authorized_keys. Organisations running public-facing image-upload features without process isolation are at the highest risk. CISA has not flagged known ransomware campaign use, but the extreme EPSS percentile and the potential for chained exploitation make this a high-priority remediation item for any NIS2-scoped operator.

Runbook · Step 1

Immediate response (0-24 h)

  • Update ImageMagick to version 6.9.3-10 (stable branch) or 7.0.1-1 (7.x branch) or later — packages are available via apt/yum/dnf; confirm the installed version with convert --version.
  • Enumerate all services and web applications that process user-supplied uploads through ImageMagick (thumbnail generation, image conversion via PHP/Python/Ruby wrappers) — these are your highest-priority assets.
  • Immediately filter any input filename or URL parameter passed to ImageMagick for the prefix ephemeral: at the application layer and reject it, as a compensating control until the patch is applied.
  • Reduce filesystem permissions of the account running ImageMagick to the minimum required — revoke write and delete rights on directories outside the designated upload temp path.
  • Enable audit logging for file-deletion syscalls (unlink/unlinkat) on affected hosts so that any exploitation that has already occurred can be reconstructed.

Runbook · Step 2

Mitigation layers

  • WAF/network layer: Deploy a WAF rule that inspects HTTP multipart upload bodies and URL parameters for the string ephemeral: (case-insensitive) and blocks the request. Extend the rule to cover other ImageMagick pseudo-protocols abused in the broader ImageTragick family (https:, ftp:, label:, msl:).
  • ImageMagick policy hardening: Disable the EPHEMERAL coder in /etc/ImageMagick-6/policy.xml (or /etc/ImageMagick-7/) by adding: <policy domain="coder" rights="none" pattern="EPHEMERAL" />. This control is effective even without a patch and should be applied immediately.
  • Process isolation / least privilege: Run ImageMagick inside an AppArmor profile, seccomp sandbox, or dedicated container without host bind-mounts, so that a successful exploit cannot reach files outside the sandbox boundary.
  • Input validation: Validate uploaded files against allowed MIME types and magic bytes (libmagic) before passing them to ImageMagick — file-extension checks alone are insufficient.
  • File integrity monitoring: Apply AIDE or equivalent FIM to web roots, configuration directories, and credential stores to detect unexpected deletions immediately.

Runbook · Step 3

Detection rules

  • auditd: Monitor unlink/unlinkat syscalls originating from ImageMagick binaries (convert, mogrify, identify) where the target path falls outside the designated temp directory: auditctl -a always,exit -F arch=b64 -S unlink -S unlinkat -F exe=/usr/bin/convert -k imagemagick_delete
  • Web server access logs (Apache/Nginx): Search for ephemeral%3A or ephemeral: in POST body logs and URL parameters — SPL: index=webserver sourcetype=access_combined | search uri_query="*ephemeral*" OR post_data="*ephemeral*"
  • Process ancestry (EDR/auditd execve): Alert on the chain web-server-worker → convert/mogrify followed by an unlink syscall targeting a non-temp path — treat as high severity.
  • FIM alert: Any unexpected deletion of files under /etc/, /var/www/, /home/, or credential stores attributable to the ImageMagick process user should trigger immediate escalation.
  • Sigma shape: title: ImageMagick EPHEMERAL Protocol Abuse | logsource: product: linux, category: process_creation | detection: selection: CommandLine|contains: 'ephemeral:' | condition: selection

Metrics

Severity
critical
Priority score
159.90
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
—
CVSS v3
—
CVSS v4
—
EPSS percentile
99.5 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
75.4 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2021-11-03 00:00 UTC
CWE
—

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2016-3715