CVE-2026-111813
Description
A flaw was found in Apache Traffic Server. When the experimental magick plugin is enabled without argument signing, an unauthenticated remote attacker can control command-line parameters passed to the underlying ImageMagick conversion utility. An attacker could exploit this argument injection flaw to achieve arbitrary code execution on the host system.
Statement
This vulnerability is rated as an Important impact because an unauthenticated remote client can inject arbitrary arguments into ImageMagick commands, potentially resulting in unauthorized file read or remote execution in severe scenarios. However, exploitation requires the experimental magick plugin to be explicitly enabled in the server configuration, as it is not loaded by default. Systems operating with standard configurations that do not load this optional plugin are not exposed to this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
