CVE-2026-122006

CVSS 9.8 (critical) · published 2026-11-04

The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.

Weakness: CWE-1188

Source: NVD CVE-2026-122006

References

• https://github.com/rails/rails/releases/tag/v8.0.5.2
• https://github.com/rails/rails/releases/tag/v8.1.4.1
• https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9
• https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-11-04/TIER_2_CVE-2026-122006.md
• https://github.com/digitalocean/droplet-1-clicks/pull/488
• https://github.com/rubysec/ruby-advisory-db/pull/1300

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.