← CVE Intelligence

CVE-2026-111813

Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration PUBLISHED

Description (CNA)

Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration. This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

Affected (CNA)

Vendor / productVersions
Apache Software Foundation / Apache Traffic Serveraffected 8.0.1 through 8.1.11; affected 9.0.0 through 9.2.15; affected 10.0.0 through 10.1.4; affected 10.2.0

CWE

CWE-88

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.