{"id":"CVE-2026-111813","kind":"vulnerability","aliases":["CVE-2026-111813"],"related":[],"title":"Apache Traffic Server: unauthenticated clients control ImageMagick convert arguments","description":"Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration.\n\n\n\nThis issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.\n\n\n\nUsers are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.","summary":"Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default unsigned configuration. An attacker can pass crafted arguments through requests to the proxy, which may lead to code execution on the server.","severity":"critical","cvss":10.0,"epss":0.00347,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-traffic-server","image-processing","imagemagick","package","runtime","self-hosted"],"not_affected_if":["magick-plugin-not-loaded","version-outside-affected-ranges"],"how_to_check":"Check the Traffic Server version (traffic_server -V or the installed package) and whether the magick plugin is loaded in plugin.config.","fix":"Upgrade to 9.2.16, 10.1.5, or 10.2.1. Or remove the magick plugin from plugin.config until upgraded.","status":"open","published_at":"2026-10-21T19:16:59+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-23T22:32:56+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T22:32:56Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to 9.2.16, 10.1.5, or 10.2.1. Or remove the magick plugin from plugin.config until upgraded.","reach":"internet","title":"Apache Traffic Server: unauthenticated clients control ImageMagick convert arguments","impact":"high","summary":"Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default unsigned configuration. An attacker can pass crafted arguments through requests to the proxy, which may lead to code execution on the server.","category":"runtime","who_cares":["apache-traffic-server","imagemagick","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker controls ImageMagick arguments and may run commands on the server","analyst_note":"Confirm from the NVD or ASF advisory whether the default config enables magick and whether argument injection gives command execution; the sources only say control of convert arguments.","how_to_check":"Check the Traffic Server version (traffic_server -V or the installed package) and whether the magick plugin is loaded in plugin.config.","needs_analyst":true,"not_affected_if":["magick-plugin-not-loaded","version-outside-affected-ranges"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000535,"input_tokens":2999,"output_tokens":470,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-111813':12A,15A '-2026':11A,14A '10.0.0':104C '10.1.4':106C '10.1.5':116C '10.2.0':107C '10.2.1':118C '8.0.1':96C '8.1.11':98C '9.0.0':100C '9.2.15':102C '9.2.16':115C 'affect':91C 'apach':1A,17B,29B,69C,92C 'apache-traffic-serv':16B 'argument':9A,43B,54B,83C 'attack':50B 'client':5A,39B,79C 'code':64B 'configur':48B,88C 'control':6A,40B,80C 'convert':8A,42B,82C 'craft':53B 'cve':10A,13A 'default':46B,86C 'execut':65B 'experiment':33B,73C 'fix':120C 'host':28B 'imag':21B 'image-process':20B 'imagemagick':7A,23B,41B,81C 'issu':90C,122C 'lead':62B 'let':36B,76C 'magick':34B,74C 'may':61B 'packag':24B 'pass':52B 'plugin':35B,75C 'process':22B 'proxi':59B 'recommend':110C 'request':56B 'runtim':25B 'self':27B 'self-host':26B 'server':3A,19B,31B,68B,71C,94C 'traffic':2A,18B,30B,70C,93C 'unauthent':4A,38B,78C 'unsign':47B,87C 'upgrad':112C 'user':108C 'version':114C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T19:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111813","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111813","severity":null,"published_at":"2026-10-21T19:16:59+00:00","modified_at":"2026-10-23T12:18:09+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-111813","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111813","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}