CVE-2026-122006
Received Received - Intake

Active Storage ImageMagick File Read Write in Ruby on Rails

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: MITRE

Description
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-122006
EUVD
EUVD-2026-116914

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
rubyonrails Active Storage 0
rubyonrails Active Storage 8.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1188 The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-122006 is a critical vulnerability in Ruby on Rails' Active Storage component. It affects versions 8.1.x before 8.1.4.1 and 8.0.x before 8.0.5.2. The flaw allows unauthenticated attackers to perform arbitrary file read and write operations on the server when ImageMagick processes file attachments. This happens because ImageMagick can be manipulated into executing coders that access files referenced within images, bypassing Active Storage's initial security constraints.

Detection Guidance

Check Rails version with 'rails -v' to see if it is below 8.1.4.1 or 8.0.5.2. Inspect Active Storage configuration for ImageMagick usage. Review ImageMagick policy files for unrestricted coders. Monitor file uploads for unexpected read/write operations.

Impact Analysis

This vulnerability can allow attackers to read sensitive files on your server, such as secret_key_base or credentials, if your application uses Active Storage with the Disk service. It may also enable remote code execution or lateral movement to other systems. Attackers only need to upload a specially crafted file; no additional actions are required.

Mitigation Strategies

Upgrade Rails to version 8.1.4.1 or 8.0.5.2 immediately. Ensure MiniMagick is updated to at least 5.1. Apply stricter ImageMagick security policies to block high-risk coders. Disable unnecessary ImageMagick features like MSL scripting and Ghostscript.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-122006. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...