{"id":"CVE-2026-122006","published":"2026-11-04T15:17:42.940","lastModified":"2026-11-04T21:18:07.027","description":"The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-1188"],"vendors":[],"products":[],"references":[{"url":"https://github.com/rails/rails/releases/tag/v8.0.5.2","tags":[]},{"url":"https://github.com/rails/rails/releases/tag/v8.1.4.1","tags":[]},{"url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","tags":[]},{"url":"https://github.com/digitalocean/droplet-1-clicks/pull/488","tags":[]},{"url":"https://github.com/rubysec/ruby-advisory-db/pull/1300","tags":[]}],"exploitRefs":[{"url":"https://github.com/rails/rails/releases/tag/v8.0.5.2","tags":[]},{"url":"https://github.com/rails/rails/releases/tag/v8.1.4.1","tags":[]},{"url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","tags":[]},{"url":"https://github.com/digitalocean/droplet-1-clicks/pull/488","tags":[]},{"url":"https://github.com/rubysec/ruby-advisory-db/pull/1300","tags":[]}],"hasPoc":true,"ai":{"summary":"The activestorage gem before 8.1.4.1 for Ruby on Rails allows arbitrary file read and write operations via ImageMagick attachment processing because the analyzer runs during file attachment without a security policy to restrict dangerous ImageMagick features, potentially exposing secrets like secret_key_base.","exploitability":"Exploitation requires an attacker to upload a maliciously crafted image file that triggers unsafe ImageMagick functionality; no authentication or user interaction is needed.","blast_radius":"Successful exploitation could lead to full system compromise including credential theft, remote code execution via file writes, and complete data breach of the application and underlying infrastructure.","remediation":"Upgrade to activestorage gem version 8.1.4.1 or later, and ensure an ImageMagick security policy is configured to block unsafe operations such as file:// access and shell command invocation.","detection":"Look for anomalous ImageMagick log entries indicating use of restricted coders (e.g., 'file:', 'http:', 'https:') or execution of non-whitelisted delegates; also monitor for unexpected reads of sensitive files (e.g., config files, environment variables) by the Rails application process during ActiveStorage processing.","tags":["rce","credential-theft","web","image-processing","imagemagick","ruby-on-rails"],"model":"garnet-coder","analyzedAt":"2026-11-05T09:45:50.119Z"}}