CVE-2026-122006 activestorage: activestorage: arbitrary file read and write via ImageMagick attachment analysis
CriticalCVSS 9.8
- Published
- Updated
- Exploit status
- No public exploit known
Description
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat/3scale-amp2/system-rhel8(Red Hat:3scale:2.13) | All versions | No fix listed |
| redhat/3scale-amp2/zync-rhel9(Red Hat:3scale:2.13) | All versions | No fix listed |
| redhat/rubygem-activestorage(Red Hat:satellite:6) | All versions | No fix listed |
| rubygems activestorage | < 8.0.5.2 | 8.0.5.2 |
| rubygems activestorage | >= 8.1, < 8.1.4.1 | 8.1.4.1 |
References
- Red Hat CVE page mitigation vendor-advisory
- Red Hat Bugzilla 2566942 issue-tracking
- www.cve.org
- nvd.nist.gov
- github.com
- github.com
- github.com
- github.com
- github.com
- github.com