Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2026-122006

The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) be

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mitre

Description

The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

rubyonrails Active Storage

Default version status: unaffected

  • 0 to < 8.0.5.2affected
  • 8.1 to < 8.1.4.1affected
pkg:gem/activestorage

References