CVE-2019-12921

What it actually does

Allows remote file read of arbitrary system files by abusing the TranslateTextEx function when processing a crafted SVG image that references a malicious text filename component.

Why it matters to the business

Attackers can exfiltrate sensitive configuration files, credentials, or other data from systems that process user-supplied images, increasing breach risk and compliance exposure; the flaw remains unpatched in many older distributions despite being public for years.

How an attack unfolds

An attacker creates a minimal SVG file containing a text element whose filename attribute is set to a path traversal string such as '../../etc/passwd'. When a victim application uses GraphicsMagick to render or inspect the SVG, TranslateTextEx follows the filename and returns the file contents in the image metadata or error output, allowing the attacker to retrieve the data.

How to fix it

Upgrade GraphicsMagick to version 1.3.32 or newer on all affected systems; rebuild or reinstall any packages that statically link older versions; apply vendor patches for Debian, openSUSE Leap, and Backports SLE as they become available.

How to confirm the fix worked

Run 'gm version' and confirm the reported version is 1.3.32 or later; re-test SVG processing with a known path-traversal test file and verify that file contents are no longer returned; scan package databases for any remaining pre-1.3.32 GraphicsMagick binaries.

Typical attack path

1. Craft malicious SVG containing path traversal in text filename component
2. Deliver SVG to target via upload, email attachment, or web page
3. Victim application invokes GraphicsMagick on the file (e.g., thumbnail generation, format conversion)
4. TranslateTextEx resolves the filename and leaks file contents
5. Attacker receives file data through image output, logs, or side-channel

How to detect it

Search web server and application logs for SVG uploads followed by unusual file paths or error messages containing system file contents; inspect GraphicsMagick process command lines and output for references to TranslateTextEx or unexpected file reads; review SIEM events for image-processing binaries accessing sensitive directories.

What your security team should do

• Immediately inventory all systems using GraphicsMagick and prioritize upgrade to 1.3.32+
• Add GraphicsMagick version checks to CI/CD and container build pipelines
• Block or sanitize SVG uploads in any application that invokes GraphicsMagick
• Monitor EPSS and KEV updates for future exploitation activity