AIncient Labs, home

ImageMagick and image updates

Atelier 0.22.0 updates ImageMagick to fix 13 High-rated vulnerabilities, updates a console library, and moves the database server, web server and updater to images without their known Critical and High vulnerabilities.

ATELIER-SA-2026-003 ·

Severity
High
Affected
Atelier < 0.22.0
Fixed in
Atelier 0.22.0
References
CVE-2026-86420, CVE-2026-86421, CVE-2026-93589, CVE-2026-93590, CVE-2026-106565, CVE-2026-106567, CVE-2026-106573, CVE-2026-106576, CVE-2026-106578, CVE-2026-106579, CVE-2026-106580, CVE-2026-107209, CVE-2026-119123, CVE-2023-54404

Our new weekly dependency scan checked the last two Atelier releases against published vulnerabilities for the first time. Atelier 0.22.0 fixes what it found. 0.21.0 and 0.20.0 are both affected.

What is fixed

  • ImageMagick 7.1.2-35 (was 7.1.2-27). ImageMagick resizes and converts every image your site processes. 13 vulnerabilities rated High are fixed. Exploiting them needs a crafted image file that your site processes, for example one uploaded through the media library.
  • zod 4.6.7, a validation library bundled into the console, fixes CVE-2023-54404 (High).
  • The database server moves from pgvector/pgvector:pg16 (Debian 12) to pgvector/pgvector:pg16-trixie (Debian 13), the same PostgreSQL 16 and pgvector. The old image carried 36 known Critical and High vulnerabilities, most in a helper that only runs when the container starts. The database is never reachable from outside the appliance's own network.
  • The web server in front of your site moves to nginx:1.30-alpine-slim: the same nginx, without the tools nginx never uses that carried most of the image's advisories.
  • The updater is built on docker:29-cli, a Docker release that still receives fixes.

What to do

  • Update to 0.22.0. With the Atelier Manager, run atelier app update. Installed with the install script, re-run the installer as described in Upgrade; it also rewrites compose.yaml with the new database and web server images.
  • The first start on the new database image takes a little longer. The new system libraries sort some text differently, so your site rebuilds its database indexes once. Your data is not changed.
  • With the Atelier Manager, the database and web server images move with the next Manager release (atelier app update after updating the Manager). atelier doctor warns until then.