Description
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.
References
- www.cve.org/CVERecord ↗
- nvd.nist.gov/vuln/detail/CVE-2026-122006 ↗
- github.com/rails/rails/releases/tag/v8.0.5.2 ↗
- github.com/rails/rails/releases/tag/v8.1.4.1 ↗
- github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9 ↗
- github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-11-04/TIER_2_CVE-2026-122006.md ↗
- github.com/digitalocean/droplet-1-clicks/pull/488 ↗
- github.com/rubysec/ruby-advisory-db/pull/1300 ↗
Related CVEs
← CVE Index: search every CVE from the last 30 days
This product uses the NVD API but is not endorsed or certified by the NVD. CVSS scores do not establish exploitation.