---
id: "CVE-2026-111813"
kind: "vulnerability"
aliases: ["CVE-2026-111813"]
title: "Apache Traffic Server: unauthenticated clients control ImageMagick convert arguments"
severity: "critical"
cvss: 10.0
epss: 0.00347
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["apache-traffic-server", "image-processing", "imagemagick", "package", "runtime", "self-hosted"]
not_affected_if: ["magick-plugin-not-loaded", "version-outside-affected-ranges"]
published_at: "2026-10-21T19:16:59+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-24T13:15:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111813", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-111813", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Apache Traffic Server: unauthenticated clients control ImageMagick convert arguments

Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default unsigned configuration. An attacker can pass crafted arguments through requests to the proxy, which may lead to code execution on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the Traffic Server version (traffic_server -V or the installed package) and whether the magick plugin is loaded in plugin.config.

## Fix

Upgrade to 9.2.16, 10.1.5, or 10.2.1. Or remove the magick plugin from plugin.config until upgraded.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111813
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-111813

## From the sources

Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration.



This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.



Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_