CVE-2026-111813: Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration
Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration.
This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 9.2.16 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.1.5 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 10.2.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Apache Traffic Server deployments using the experimental magick plugin are exposed when it is in its default unsigned configuration. The affected Traffic Server versions are 8.0.1 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0.
What does an attacker need to exploit this issue?
An attacker only needs network access to send requests to the affected service. No authentication or user interaction is required, because client query strings can control ImageMagick convert arguments in the default configuration.
Which upgrades fix the issue?
Upgrade to Apache Traffic Server 9.2.16, 10.1.5, or 10.2.1. These are the versions identified as fixing the issue.