Apache Traffic Server: Command argument injection in experimental magick plugin

Summary

The experimental magick plugin of Apache Traffic Server passes client-supplied query strings unfiltered to ImageMagick's convert utility in the default configuration. An unauthenticated remote attacker can control the convert arguments, which the CNA rates as a critical issue with high impact on confidentiality, integrity and availability. The plugin is not active by default and must be explicitly loaded in plugin.config, and the risk is highest when no signing key is configured.

Affected

• Apache Traffic Server 8.0.1 through 8.1.11
• Apache Traffic Server 9.0.0 through 9.2.15
• Apache Traffic Server 10.0.0 through 10.1.4
• Apache Traffic Server 10.2.0 (unaffected in the default configuration, according to the CNA record)

Fixed in

• Upgrade 9.x to 9.2.16
• Upgrade 10.1.x to 10.1.5
• Upgrade 10.2.0 to 10.2.1
• 8.x: Unknown. No fixed release was found in the sources checked; ask the ASF or your distribution.

Workaround

• Unload the magick plugin if it is not needed.
• Configure a signing key for the magick plugin.
• Disable other experimental plugins (such as tsmemcache and wasm) if they are not needed.
• Check plugin.config; the default configuration is empty, so the plugin is inactive unless added.

Exploitation

• A public proof of concept exists: a security research team published a write-up on 13 October 2026, before the CVE was assigned. It reportedly demonstrates a file write under the Traffic Server user when the plugin is loaded without a verify key and ImageMagick policy.xml permits the convert path.
• No active exploitation is known; the CISA KEV status is not listed.
• The EPSS score is low (about 0.5%).
• The NVD entry was still under analysis at the time of writing, so the CVSS score comes from the CNA.

Our recommendation

• Check whether any Apache Traffic Server instance exists and whether the magick plugin is loaded.
• If the magick plugin is loaded, unload it or configure a signing key immediately.
• Upgrade to 9.2.16, 10.1.5 or 10.2.1 as applicable.
• For 8.x, ask the vendor or distribution about a fix.
• Verify whether the Traffic Server instance is reachable from the internet and restrict access where possible.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• ASF mailing list announcement lists.apache.org
• Apache Traffic Server security page 2026-10 trafficserver.apache.org
• Ubuntu security tracker ubuntu.com
• Rescana security release summary www.rescana.com
• SecurityOnline vulnerability overview securityonline.info
• Public proof of concept repository github.com
• NVD entry via Vulners vulners.com
• Strix CVE overview www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:04.