← CVE Radar
CVE-2026-122006
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.
9.8 CRITICALEPSS 0.74%Not in KEVNVD: Received
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1mitre (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Details
- CVE ID
- CVE-2026-122006
- Status
- Received
- Assigner (CNA)
- mitre
- Published
- Nov 4, 2026
- Last modified
- 2026-11-05 17:18 UTC
- Weaknesses
- CWE-1188 · Initialization of a Resource with an Insecure Default
Affected Products
As published by the CNA in the CVE record.
rubyonrailsActive Storage2 version ranges
- before 8.0.5.2
- 8.1 before 8.1.4.1
References
- github.com https://github.com/rails/rails/releases/tag/v8.0.5.2
- github.com https://github.com/rails/rails/releases/tag/v8.1.4.1
- github.com https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9
- github.com https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-11-04/TIER_2_CVE-2026-122006.md
- github.com https://github.com/digitalocean/droplet-1-clicks/pull/488
- github.com https://github.com/rubysec/ruby-advisory-db/pull/1300