PatchTheCVECVE-2026-122006: The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can all
CVE-2026-122006 is a critical-severity flaw (CVSS 9.8) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | n/a |
| CISA exploited list | No |
| Weakness | CWE-1188 |
| Published | 2026-11-04 |
| Last modified | 2026-11-04 |
Last updated 2026-11-04 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Timeline
- Published CVE record published
- Updated Record last modified
Advisories and coverage
Research and news
- VulDB Recent Entries: CVE-2026-122006 | Ruby on Rails Active Storage prior 8.0.5.2/8.1.4.1 Analyzer information disclosure 2026-11-04
- Vulners Bulletins: CVE-2026-122006 2026-11-04
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-122006?
No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.
Is CVE-2026-122006 being exploited?
CVE-2026-122006 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-122006 affect?
CVE-2026-122006 affects affected software. Severity is critical (CVSS 9.8). The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached,
How urgent is CVE-2026-122006?
Priority 39/100. Critical severity; Remotely exploitable, no login, no user action
Software pages
Ruby on Rails vulnerabilities · Ruby vulnerabilities · ImageMagick vulnerabilities