CVE-2026-111813 Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration.

Critical 10.0 Published 21 Oct 2026 Updated 23 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-111813?

CVE-2026-111813 is a critical vulnerability in Apache Traffic Server, published on 21 Oct 2026.

Official description

Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration.

This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.

Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

Weakness: CWE-88

Which versions are affected by CVE-2026-111813?

How do I fix CVE-2026-111813?

No fix has been published for CVE-2026-111813 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-111813 being exploited?

There is no known exploitation of CVE-2026-111813 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-111813, GHSA-c2v6-rh8p-xq4c, UBUNTU-CVE-2026-111813.