Arbitrary File Deletion via ImageMagick ‘ephemeral’ Protocol (CVE‑2016‑3715)
What It Is
ImageMagick’s “ephemeral” pseudo‑protocol reads a file and then automatically deletes it. A flaw in the implementation allows an attacker to trigger the deletion step without proper authorization, resulting in arbitrary file removal on the host running the library.
Exploitability
- No public evidence of widespread active exploitation, but proof‑of‑concept code demonstrating the deletion behavior has been released.
- CVSS v3.1 base score is 6.5 (Medium), reflecting the ability to cause data loss without requiring elevated privileges.
Affected Products
- ImageMagick (all versions prior to the vendor‑issued patch that disables or secures the “ephemeral” protocol).
- Any application or service that embeds ImageMagick for image processing.
Why It Matters for Compliance & Audit Readiness
- Control‑Assurance Lens: Unauthorised file deletion undermines data‑integrity controls and can break evidence‑preservation requirements for regulations such as GDPR, HIPAA, and PCI‑DSS.
- Continuous Control Monitoring: Detecting the use of the “ephemeral” protocol should be part of your configuration‑baseline monitoring. Evidence that the protocol is disabled or that the library is patched provides a defensible audit trail for vendor‑management and change‑control controls.
- One Relevant Capability – Vendor‑Management Controls: Maintaining an up‑to‑date inventory of third‑party components (ImageMagick) and verifying that security patches are applied demonstrates due‑diligence in the vendor‑risk lifecycle, a key audit artifact.
Recommended Actions
- Patch Immediately – Upgrade ImageMagick to the version that removes or secures the “ephemeral” protocol.
- Disable the Protocol – If the feature is not required, configure ImageMagick to reject “ephemeral” URLs.
- Asset Inventory & CMDB Update – Record all systems that ship ImageMagick, map the vulnerability to the “Data Integrity” control, and capture remediation evidence.
- Continuous Monitoring – Add a rule to your SIEM or configuration‑management tooling to alert on any use of the “ephemeral” protocol.
- Validate Post‑Remediation – Run a controlled test to confirm that file deletion can no longer be triggered, and archive the test logs for audit purposes.
Source: CISA KEV – CVE‑2016‑3715