# CVE-2026-122006

ActiveStorage ImageMagick analyzer enables server read/write, risking secret exposure.

- Page: https://www.vulneraibility.com/cve/CVE-2026-122006
- CVSS: 9.8
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-1188
- Also known as: GHSA-f3w6-w445-fwh9
- Published: 2026-11-04

## Affected versions

- rubyonrails Active Storage: affected < 8.0.5.2; >= 8.1 and < 8.1.4.1

A version outside these ranges is not a statement that it is unaffected.

## Impact

Attacker can trigger ImageMagick analysis on uploads to read/write server files (expose secret_key_base) and potentially enable RCE.

## Action

Immediate action required

## Recommendation

Upgrade activestorage to 8.1.4.1+ and enforce ImageMagick security policy.

## References

- [other] https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9
- [other] https://github.com/rails/rails/releases/tag/v8.1.4.1
- [other] https://github.com/rails/rails/releases/tag/v8.0.5.2
- [other] https://github.com/digitalocean/droplet-1-clicks/pull/488
- [other] https://github.com/rubysec/ruby-advisory-db/pull/1300

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.