CVE-2026-122006: Rails Active Storage ImageMagick Analyzer Enables Server File Read and Write

CVE-2026-122006: Critical Active Storage Flaw in Ruby on Rails

A critical vulnerability, tracked as CVE-2026-122006 with a CVSS score of 9.8, was published to the NVD on 2026-11-04. It affects the activestorage gem for Ruby on Rails before version 8.1.4.1.

According to the NVD description, when ImageMagick attachment processing is in use, the flaw can allow server read and write operations, for example reading the application's secret_key_base. The cause is that the ImageMagick analyzer runs as soon as a file is attached, and no ImageMagick security policy is in place to block unsafe operations.

Vulnerability Overview

Why This Matters

The analyzer runs when a file is attached, so the dangerous processing can be reached by anyone able to upload an attachment. The NVD description names secret_key_base as an example of what could be read. That secret signs and encrypts sessions and cookies, so exposure could let an attacker forge sessions and escalate the compromise beyond the image-processing step. The write capability adds a further risk to the host.

The NVD entry's description is the only detail confirmed at the time of writing. Exploitation in the wild has not been reported in the sources we reviewed.

Remediation

1. Upgrade activestorage (via your Rails version) to 8.1.4.1 or later.
2. Define an ImageMagick security policy (policy.xml) that blocks risky coders and delegates, and restricts file read and write paths. The missing policy is the stated root cause.
3. Rotate secret_key_base and other secrets if you have reason to believe an untrusted upload was processed on a vulnerable version. Rotation invalidates existing sessions.
4. Review upload endpoints that accept user attachments and consider restricting accepted content types.
5. Check logs for unusual attachment uploads and unexpected ImageMagick process activity.

References

• NVD: CVE-2026-122006