Commit 9e789499e for imagemagick.org

commit 9e789499e67dbf5c4ee9fe1b72690738c799ec73
Author: Cristy <urban-warrior@imagemagick.org>
Date:   Sat Sep 12 09:11:55 2026 -0400

    https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7q74-r26w-fwcx

diff --git a/MagickWand/script-token.c b/MagickWand/script-token.c
index a92808320..0fb3ff4a9 100644
--- a/MagickWand/script-token.c
+++ b/MagickWand/script-token.c
@@ -223,15 +223,20 @@ WandExport ScriptTokenInfo *AcquireScriptTokenInfo(const char *filename)
     token_info->opened=MagickFalse;
   }
   else if (LocaleNCompare(filename,"fd:",3) == 0 ) {
-    token_info->stream=fdopen(StringToLong(filename+3),"r");
+    token_info->stream=fdopen(StringToLong(filename+3),"rb");
     token_info->opened=MagickFalse;
   }
   else {
-    token_info->stream=fopen_utf8(filename, "r");
+    int fd = open(filename,O_RDONLY | O_CLOEXEC | O_NOFOLLOW);
+    if (fd != -1)
+      token_info->stream=fdopen(fd,"r");
     if (token_info->stream != (FILE *) NULL)
       token_info->opened=MagickTrue;
+    else
+      fd=close_utf8(fd)-1;
   }
-  if ( token_info->stream != (FILE *) NULL )
+  if ((token_info->stream != (FILE *) NULL) &&
+      (IsPathAuthorized(ReadPolicyRights,filename) != MagickFalse))
     token_info->opened=MagickTrue;
   else
     {