Loading vulnerability…
Server-side file read and write in Rails Active Storage ImageMagick processing
CVE-2026-122006 affects the Ruby on Rails activestorage gem before version 8.1.4.1 when ImageMagick processes attachments. The ImageMagick analyzer runs when a file is attached, and the absence of a restrictive ImageMagick security policy permits unintended functionality that can enable server-side file reads and writes. Exploitation can expose application secrets, including secret_key_base, and compromise server-side data.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disclose sensitive server-side information, including secret_key_base, and permit unauthorized file writes. The supplied CVSS v3.1 vector assigns high confidentiality, integrity, and availability impacts, with a critical score of 9.8. The specific mechanism for availability impact is not established.
If you can’t patch tonight, do this now.
Configure an ImageMagick security policy that blocks unintended functionality and restricts file access to operations required for attachment processing. If an appropriate policy cannot be enforced, disable ImageMagick-based attachment analysis and processing until the application is patched.
Patch, then assume compromise.
Upgrade the activestorage gem to version 8.1.4.1 or a later patched release. Ensure the deployed application's resolved dependencies include the patched version.
No public exploits tracked yet. Mallory keeps watching.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.