CVE-2026-122006
rubyonrails Active Storage
Published 4 Nov 2026 · updated 4 Nov 2026 · Received
9.8 Critical · CVSS 3.1, mitre.org
Description
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.