Commit 11977ca6c for imagemagick.org

commit 11977ca6cdb1b028c6fc2de0726ff027a8457445
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Tue Oct 13 14:21:08 2026 -0400

    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vmj6-qx38-9gf5

diff --git a/coders/inline.c b/coders/inline.c
index 6ba59254a..4dc92667b 100644
--- a/coders/inline.c
+++ b/coders/inline.c
@@ -58,6 +58,7 @@
 #include "MagickCore/string_.h"
 #include "MagickCore/module.h"
 #include "MagickCore/utility.h"
+#include "MagickCore/utility-private.h"
 #include "MagickCore/xwindow.h"
 #include "MagickCore/xwindow-private.h"

@@ -92,6 +93,17 @@ static MagickBooleanType
 %    o exception: return any errors or warnings in this structure.
 %
 */
+
+static MagickBooleanType IsInlineFileAccessible(const char *filename)
+{
+  if ((filename == (const char *) NULL) || (*filename == '\0'))
+    return(MagickFalse);
+  if ((*filename == '|') || (LocaleCompare(filename,"-") == 0) ||
+      (LocaleNCompare(filename,"fd:",3) == 0))
+    return(MagickFalse);
+  return(IsPathAccessible(filename));
+}
+
 static Image *ReadINLINEImage(const ImageInfo *image_info,
   ExceptionInfo *exception)
 {
@@ -136,6 +148,12 @@ static Image *ReadINLINEImage(const ImageInfo *image_info,
       filename=DestroyString(filename);
       return(data_image);
     }
+  if (IsInlineFileAccessible(image_info->filename) == MagickFalse)
+    {
+      (void) ThrowMagickException(exception,GetMagickModule(),PolicyError,
+        "NotAuthorized","`%s'",image_info->filename);
+      return((Image *) NULL);
+    }
   image=AcquireImage(image_info,exception);
   status=OpenBlob(image_info,image,ReadBinaryBlobMode,exception);
   if (status == MagickFalse)