External risk intelligence

Apache Traffic Server Magick Plugin Argument Control Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-111813

Apache Traffic Server is a high-performance web proxy and caching server designed to operate at the network edge. Because it is explicitly built to be a public-facing gateway or reverse proxy that handles incoming traffic, its components and plugins are positioned at the internet-facing perimeter by design.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

The Apache Traffic Server, a web proxy and caching server, has a vulnerability within its experimental magick plugin that could allow unauthenticated attackers to manipulate ImageMagick convert arguments. This issue affects specific versions of the software.

Unauthenticated control over image conversion arguments.
Impacts internet-facing web proxy servers.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to a server running Apache Traffic Server with the experimental magick plugin enabled. This plugin, when improperly configured, allows unauthenticated clients to directly manipulate ImageMagick commands. Successful exploitation could lead to arbitrary code execution.

No authentication required.
Triggered via crafted network requests.
Leads to arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

When the experimental magick plugin is enabled in its default configuration, an unauthenticated client could manipulate ImageMagick convert arguments, potentially affecting the integrity and availability of the Apache Traffic Server.

Server configuration and image processing.
Unauthenticated client can control arguments.
Impacts service integrity and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Apache Traffic Server's magick plugin, which allows unauthenticated control over ImageMagick arguments, is critical and likely impacts network edge infrastructure. The platform or infrastructure team responsible for Apache Traffic Server deployments should lead the remediation effort. The first practical step is to identify all instances of the affected Traffic Server versions, determine their exposure to the internet, and confirm their business criticality. Once identified, a risk-based remediation plan, potentially involving vendor coordination for updates or the implementation of temporary mitigating controls, should be developed and executed.

Platform/Infrastructure teams own the issue.
Verify public-facing Traffic Server instances.
Plan and coordinate vendor-supported updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache Traffic Server and what does the magick plugin do?

Apache Traffic Server is a high-performance web proxy and caching server that sits at the network edge to accelerate web traffic. The experimental magick plugin is an optional component for this software that uses ImageMagick to perform image processing tasks directly on the proxy server as it handles requests.

How does CVE-2026-111813 work?

This vulnerability involves an issue classified as CWE-88: Argument Injection. Because the magick plugin does not properly sanitize input in its default, unsigned configuration, an attacker can supply malicious commands. These commands are then executed by ImageMagick, allowing the attacker to manipulate the image conversion process.

Do I need to be authenticated to trigger this vulnerability?

No, authentication is not required. The vulnerability is triggered by sending a specially crafted network request to the server. If the magick plugin is enabled and using its default, unsigned configuration, the server will process the malicious arguments automatically. Simply disabling the plugin or ensuring it is not in the default configuration prevents this specific trigger path.

Is my server at risk if it runs Apache Traffic Server?

According to Halo Surface Signal, this software is specifically designed as a public-facing gateway or reverse proxy at the network edge. Because it is intended to handle incoming traffic from the internet, any instance running the affected versions with the magick plugin enabled is likely to be reachable by external attackers.

What should I do first to address this CVE?

First, identify all instances of Apache Traffic Server within your environment to see if they are running the affected versions. Check if the experimental magick plugin is enabled. If it is, prioritize updating your software to version 9.2.16, 10.1.5, or 10.2.1, which contain the necessary fixes provided by the vendor.

References

lists.apache.org/thread/r95dq29ywcd1f4x30snxlqmb12z4s4kc

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.