CVE-2026-111813 is a vulnerability in Apache Traffic Server
Published on October 21, 2026
Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration
Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration.
This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.
Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Vulnerability Analysis
CVE-2026-111813 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Type
What is an Argument Injection Vulnerability?
The software constructs a string for a command to executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
CVE-2026-111813 has been classified to as an Argument Injection vulnerability or weakness.
Products Associated with CVE-2026-111813
Want to know whenever a new CVE is published for Apache Traffic Server? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Traffic Server:- Version 8.0.1, <= 8.1.11 is affected.
- Version 9.0.0, <= 9.2.15 is affected.
- Version 10.0.0, <= 10.1.4 is affected.
- Version 10.2.0 is affected.