---
id: CVE-2026-122006
title: >-
  The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick
  attachment processing occurs, can allow server read and write operations
  (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a
  file is attach…
summary: >-
  The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick
  attachment processing occurs, can allow server read and write operations
  (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a
  file is attach…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-1188
vendor: rubyonrails
product: Active Storage
affected:
  - active_storage < 8.0.5.2
  - active_storage >= 8.1 < 8.1.4.1
exploitAvailable: true
published: '2026-11-04'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T16:41:32.160Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-122006'
references:
  - url: 'https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9'
  - url: 'https://github.com/rails/rails/releases/tag/v8.1.4.1'
  - url: 'https://github.com/rails/rails/releases/tag/v8.0.5.2'
tags:
  - cve.org
  - exploit-available
epss: 0.00741
epssPercentile: 0.54826
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/charlie-goldenowl/cve-2026-122006-check'
  checkedAt: '2026-11-06T17:03:56.635Z'
ingestedAt: '2026-11-05T22:38:31.381Z'
---

## Overview

The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.

## Affected

- `active_storage < 8.0.5.2`
- `active_storage >= 8.1 < 8.1.4.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.