VulnSocial

CVE-2026-111813

LOWCVSS 10.0 · CRITICAL

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration. This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-88

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse3 posts
  • ExploitGrid@exploitgrid

    ExploitGrid Daily Digest 🚨 Top CVEs: CVE-2026-105944 (CVSS: 10) Apache Softw... CVE-2026-111812 (CVSS: 10) Apache Softw... CVE-2026-111813 (CVSS: 10) Apache Softw... CVE-2026-111814 (CVSS: 10) Apache Softw... CVE-2026-111815 (CVSS: 10) Apache Softw... ..🧵👇

    1000056
    416 followersView on X
  • SecAlerts@SecAlertsCo

    🪄 Apache Traffic Server CVE-2026-111813: unauthenticated clients can inject arbitrary ImageMagick convert args via the magick plugin's default config. CVSS 10, no auth needed. Patch or disable now. #cybersecurity #ciso #cto #vulnerabilities https://secalerts.co/vulnerability/CVE-2026-111813?utm_campaign=x https://t.co/78NrEWIbu7

    0000047
    895 followersView on X
  • abraxas@abraxas_null

    this is was designated a CRITICAL 10 from the vendor. new CVE - https://app.opencve.io/cve/CVE-2026-111813

    0000035
    669 followersView on X

Explore more

Back to dashboard