The magick plugin in Apache Traffic Server allows an unauthenticated client to control the command-line arguments passed to ImageMagick's convert utility when the plugin is used in its default unsigned configuration. If an attacker supplies a crafted query string, the arguments can cause arbitrary commands to be executed on the server host, leading to complete compromise of confidentiality, integrity, and availability of the affected system.

The vulnerability exists in Apache Traffic Server versions 8.0.1 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0. Users are advised to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which contain the fix.

The CVSS score of 10 denotes critical severity. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a simple HTTP request to the magick plugin endpoint without any authentication. Because the plugin accepts client-supplied arguments unsanitized, exploitation is straightforward once the plugin is enabled, yielding high risk of remote code execution.