CVE-2026-56378

High

Advisory

Published 21 Jun 2026In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 8.2; base score, highest
EPSS: 0.002; 13th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 109; of 17,781 indexed, latest versions
Container images: 117; deployed by those charts
Fix available: 1 of 1; affected package

The matching OSV records carry no description.

Carried by container images the latest versions of 109 of 17,781 indexed charts deploy, on 117 images.

Affected package	Affected versions	Fixed in	Images
imagemagickdeb	8:6.8.9.9-7ubuntu5.9, 8:6.9.10.23+dfsg-2.1ubuntu11.4, 8:6.9.11.60+dfsg-1.3build2, 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+21 more	8:6.8.9.9-7ubuntu5.16+esm24, 8:6.9.10.23+dfsg-2.1ubuntu11.11+esm14, 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.5+esm14, 8:6.9.11.60+dfsg-1.6+deb12u12+1 more	117

OSV records: DEBIAN-CVE-2026-56378 UBUNTU-CVE-2026-56378
Also known as: USN-8739-1

Charts affected

109 by stars

Chart

Latest

Affected images

Radar Score

helm-testtest-helm-artifacthub

1.0.0

1 of 2 See more

helm-test test-helm-artifacthub 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-56378.

Container image	Digest	Package	Fixed in
carlosmz87/test_helm_backend :latest	8ffa63aa995d	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u2	8:6.9.11.60+dfsg-1.6+deb12u12

Open the chart page →

11,648

codegentest-opea

1.0.0

1 of 5 See more

codegen test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-56378.

Container image	Digest	Package	Fixed in
opea/codegen-ui :1.0	2bee4eb66f3e	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u1	8:6.9.11.60+dfsg-1.6+deb12u12

Open the chart page →

28,814

codetranstest-opea

1.0.0

1 of 5 See more

codetrans test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-56378.

Container image	Digest	Package	Fixed in
opea/codetrans-ui :1.0	3ef121f34610	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u1	8:6.9.11.60+dfsg-1.6+deb12u12

Open the chart page →

28,385

docsumtest-opea

1.0.0

1 of 5 See more

docsum test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-56378.

Container image	Digest	Package	Fixed in
opea/docsum-ui :1.0	7f854e9bffaf	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u1	8:6.9.11.60+dfsg-1.6+deb12u12

Open the chart page →

28,858

nextcloudth-charts

0.4.0

1 of 1 See more

nextcloud th-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-56378.

Container image	Digest	Package	Fixed in
library/nextcloud :31.0.6-apache	588609d76b21	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u3	8:6.9.11.60+dfsg-1.6+deb12u12

Open the chart page →

10,086

tfy-distributortruefoundry

0.0.1

1 of 4 See more

tfy-distributor truefoundry 0.0.1

1 of the 4 container images this version deploys carry CVE-2026-56378.

Container image	Digest	Package	Fixed in
public.ecr.aws/truefoundrycloud/async-service-distributor :5d48113bc678d694a0c8f8dabb2207c5aa2cfc53	f74851ce31f5	imagemagick@8:6.9.11.60+dfsg-1.6	8:6.9.11.60+dfsg-1.6+deb12u12

Open the chart page →

17,323

demo-backendv2fly

0.0.3

1 of 1 See more

demo-backend v2fly 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-56378.

Container image	Digest	Package	Fixed in
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	imagemagick@8:6.9.11.60+dfsg-1.6	8:6.9.11.60+dfsg-1.6+deb12u12

Open the chart page →

14,358

maybe-financevicsufer

0.2.7

1 of 3 See more

maybe-finance vicsufer 0.2.7

1 of the 3 container images this version deploys carry CVE-2026-56378.

Container image	Digest	Package	Fixed in
ghcr.io/maybe-finance/maybe :0.5.0	c6ab95ca9130	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u2	8:6.9.11.60+dfsg-1.6+deb12u12

Open the chart page →

10,795

calibre-webvista

0.1.3

1 of 1 See more

calibre-web vista 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-56378.

Container image	Digest	Package	Fixed in
linuxserver/calibre-web :0.6.24	241009026e6f	imagemagick@8:6.9.12.98+dfsg1-5.2build2	no fix listed

Open the chart page →

7,628

Container images carrying it

117 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/paperless-ngx/paperless-ngx :2.13.1	0642357c5dbd	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u2	8:6.9.11.60+dfsg-1.6+deb12u12	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.13	4b05bcd28e69	imagemagick@8:7.1.1.43+dfsg1-1+deb13u7	8:7.1.1.43+dfsg1-1+deb13u11	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.3	57ad9565bff3	imagemagick@8:7.1.1.43+dfsg1-1+deb13u3	8:7.1.1.43+dfsg1-1+deb13u11	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.5	665f2f5cc548	imagemagick@8:7.1.1.43+dfsg1-1+deb13u3	8:7.1.1.43+dfsg1-1+deb13u11	1
ghcr.io/paperless-ngx/paperless-ngx :2.0.1	ab255bea133e	imagemagick@8:6.9.11.60+dfsg-1.6	8:6.9.11.60+dfsg-1.6+deb12u12	1
ghcr.io/paperless-ngx/paperless-ngx :2.20.14	b89f83345532	imagemagick@8:7.1.1.43+dfsg1-1+deb13u7	8:7.1.1.43+dfsg1-1+deb13u11	1
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui :0.2.1-5d668c1	ed07e7ca098d	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u2	8:6.9.11.60+dfsg-1.6+deb12u12	1
ghcr.io/wgbh-mla/pbcore-util :pr-6	6e04659a3baa	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u5	8:6.9.11.60+dfsg-1.6+deb12u12	1
ghcr.io/wizarrrr/wizarr :4.2.0-beta.3	d19d886d5090	imagemagick@8:6.9.11.60+dfsg-1.6	8:6.9.11.60+dfsg-1.6+deb12u12	1
ghcr.io/zoriya/kyoo_autosync :4.7.1	fbba58ddb1a6	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u2	8:6.9.11.60+dfsg-1.6+deb12u12	1
ghcr.io/zoriya/kyoo_scanner :4.7.1	7dc0ee57b628	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u2	8:6.9.11.60+dfsg-1.6+deb12u12	1
public.ecr.aws/jtekt-corporation/image-storage-service :v1.16.17	b1493760c716	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u2	8:6.9.11.60+dfsg-1.6+deb12u12	1
public.ecr.aws/jtekt-corporation/shinsei-manager :v2.8.1	5cd62142d6ed	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u1	8:6.9.11.60+dfsg-1.6+deb12u12	1
public.ecr.aws/jtekt-corporation/time-series-storage-service :v1.5.1	046ef5c9ed50	imagemagick@8:6.9.11.60+dfsg-1.6	8:6.9.11.60+dfsg-1.6+deb12u12	1
public.ecr.aws/truefoundrycloud/async-service-distributor :5d48113bc678d694a0c8f8dabb2207c5aa2cfc53	f74851ce31f5	imagemagick@8:6.9.11.60+dfsg-1.6	8:6.9.11.60+dfsg-1.6+deb12u12	1
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	imagemagick@8:6.9.11.60+dfsg-1.6	8:6.9.11.60+dfsg-1.6+deb12u12	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer :1.0.31	0e3cd8c7776d	imagemagick@8:6.9.11.60+dfsg-1.6+deb12u9	8:6.9.11.60+dfsg-1.6+deb12u12	1