EUVD-2026-107489

Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default unsigned configuration. This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users...

CVE-2026-111813

The Apache Traffic Server experimental magick plugin is vulnerable to argument injection (CWE-88). An unauthenticated client can control ImageMagick convert arguments because the plugin passes client query strings unfiltered in its default unsigned configuration. This issue affects versions 8.0.1...