ImageMagick Arguments Manipulation in Apache Traffic Server
CVE-2026-111813

10CRITICAL

Key Information:

Vendor

Apache
Status
Apache Traffic Server
Vendor
CVE Published:
21 October 2026

What is CVE-2026-111813?

An issue in Apache Traffic Server's experimental magick plugin allows an unauthenticated client to manipulate ImageMagick convert arguments in its default configuration, leading to potential unauthorized operations. This affects multiple versions of the Apache Traffic Server, emphasizing the need for users to upgrade to secure versions such as 9.2.16, 10.1.5, or 10.2.1 to mitigate this risk.

Affected Version(s)

Apache Traffic Server 8.0.1 <= 8.1.11

Apache Traffic Server 9.0.0 <= 9.2.15

Apache Traffic Server 10.0.0 <= 10.1.4

References

https://lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb1...
vendor-advisory

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Apache Community
The ASF
Abraxas Labs
.