Apache Traffic Server EUVD-2026-107489

Exploitation requires that the operator has loaded Apache Traffic Server's experimental 'magick' plugin AND is running it in its default UNSIGNED configuration - in that mode an unauthenticated client can control the arguments passed to the ImageMagick 'convert' binary. The decisive limiting factor is that this plugin is experimental and not enabled by default, so only deployments that have deliberately added it (and have not enabled URL/request signing) are exposed; configuring the plugin's signed mode removes the unauthenticated-control condition. No user interaction or authentication is otherwise needed against a vulnerable, enabled instance.

All quantitative severity signals point to maximum theoretical risk: the vendor (Apache) CVSS:3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0, meaning a remote, unauthenticated, low-complexity attack with a scope change and full confidentiality/integrity/availability impact. CWE-88 (argument injection) is consistent with the description - an unauthenticated client controlling ImageMagick 'convert' arguments can typically coerce arbitrary file read/write, SSRF, or command-style behavior through ImageMagick, which justifies the S:C and triple-H impacts. However, the real-world priority is materially lower than the raw 10.0 implies because exploitation is gated on a precondition the CVSS base score does not express: the experimental 'magick' plugin must be explicitly loaded AND left in its default unsigned mode. This is a non-default deployment, so most ATS installations are not exposed. No EPSS score was provided, the CVE is NOT on the CISA KEV list, and no POC/exploit code is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a genuinely critical flaw for the narrow population running the experimental magick plugin unsigned, but a low-urgency item for the typical ATS operator who does not run that plugin. The only reference is the Apache security mailing-list advisory; no third-party corroboration, EPSS, or exploitation telemetry is available to refine this.

An operator has enabled Apache Traffic Server's experimental magick plugin and left it in the default unsigned configuration. A remote, unauthenticated attacker sends a crafted request whose parameters are passed into the ImageMagick 'convert' command line, injecting additional arguments that cause convert to read, write, or process attacker-chosen resources on the server. No public exploit code is referenced, so exploitation would currently require an attacker to develop their own.