CVE-2026-126082
Received
Received - Intake
Arbitrary File Write via ImageMagick in Active Storage
Vulnerability report for CVE-2026-126082, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-10
Last updated on: 2026-11-10
Assigner: GitHub, Inc.
Description
Description
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, a Rails application that processes attachments with ImageMagick may allow an unauthenticated attacker to write arbitrary files on the server and, when attachments are stored with the Disk service, to read arbitrary files readable by the application process. Those files typically include secret_key_base and credentials for external systems, which may in turn allow escalation to remote code execution or lateral movement to those systems. ImageMagick selects a coder from the content of the file it is given, and some coders act on files named inside the image rather than on the image itself. Active Storage constrained none of ImageMagick's coders, and the ImageMagick analyzer runs when a file is attached, so an attacker who can upload a crafted file may be able to invoke one. Attaching the upload is sufficient; no variant, preview, or analyze call is required. One specific attack chain has been reported, but other attack chains may exist. An application is affected when it uses ImageMagick for Active Storage image processing through config.active_storage.variant_processor = :mini_magick, runs ImageMagick under a security policy that does not already deny the involved coders, and allows uploads from untrusted users. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rails | active_storage | to 8.0.5.2 (exc) |
| imagemagick | imagemagick | to 8.0.5.2 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-1188 | The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure. |
