Vulnerability · Published Nov 4, 2026 · Assigned by mitre
CVE-2026-122006
Critical 9.8
In plain English
A critical-severity security flaw in Active Storage from rubyonrails. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | rails | no fix listed | DEBIAN-CVE-2026-122006 |
| Debian:13 | rails | no fix listed | DEBIAN-CVE-2026-122006 |
| Debian:14 | rails | no fix listed | DEBIAN-CVE-2026-122006 |
| Ubuntu:24.04:LTS | rails | no fix listed | UBUNTU-CVE-2026-122006 |
| Ubuntu:26.04:LTS | rails | no fix listed | UBUNTU-CVE-2026-122006 |
| Ubuntu:26.10 | rails | no fix listed | UBUNTU-CVE-2026-122006 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| rubyonrails | Active Storage | 0 – before 8.0.5.28.1 – before 8.1.4.1 |
Weakness: CWE-1188 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9
- https://github.com/rails/rails/releases/tag/v8.1.4.1
- https://github.com/rails/rails/releases/tag/v8.0.5.2
- https://github.com/digitalocean/droplet-1-clicks/pull/488
- https://github.com/rubysec/ruby-advisory-db/pull/1300
- https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-11-04/TIER_2_CVE-2026-122006.md