CVE-2026-122006: Critical severity vulnerability
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secretkeybase) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.
Event History
Frequently Asked Questions
Which deployments are exposed?
Ruby on Rails deployments using the activestorage gem before 8.1.4.1 are exposed when they perform ImageMagick processing of attachments. The issue is tied specifically to the ImageMagick analyzer running during file attachment.
What access would an attacker need?
An attacker needs a way to cause a file to be attached so that the ImageMagick analyzer processes it. No authentication or user interaction is required according to the supplied CVSS vector.
What can be done if upgrading is not immediately possible?
Apply an ImageMagick security policy that blocks unintended functionality. The vulnerability exists because such a policy is absent.
How can we determine whether an environment is affected?
Check whether the application uses an activestorage version earlier than 8.1.4.1 and whether ImageMagick attachment processing is enabled or occurs. Also verify whether an ImageMagick security policy is in place to restrict unintended functionality.