Read the docs
TI-2026-85069 Aliases CVE-2026-122006GHSA-wgv4-95jc-33jm

Active Storage ImageMagick analyzer allows server file read and write

Priority MEDIUM 43CWE-1188Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

The activestorage gem for Ruby on Rails is affected before 8.0.5.2 and from 8.1 before 8.1.4.1. The ImageMagick analyzer runs when a file is attached, and no ImageMagick security policy blocks unintended functionality because of an insecure default (CWE-1188). An unauthenticated remote attacker can perform server read and write operations, such as reading secret_key_base.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.

Why it matters now

EPSS 0.00741 54th percentileScored 2026-11-07
Fix Partial Active Storage (rubyonrails): 8.0.5.2, 8.1.4.1Red Hat: 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
RailsActive Storagebefore 8.0.5.2; 8.1 to before 8.1.4.18.0.5.2, 8.1.4.1Patch availableCNA
  • Active Storage VendorRails Affected before 8.0.5.2; 8.1 to before 8.1.4.1 Fixed in 8.0.5.2, 8.1.4.1 Patch available CNA

Remediation

Upgrade Active Storage to 8.0.5.2 or 8.1.4.1. Red Hat 3scale API Management Platform 2 has no fix planned, and Red Hat Satellite 6 has no fix available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Active Storage (rubyonrails) Fixed in 8.0.5.2, 8.1.4.1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat 3scale API Management Platform 2AffectedNo fix planned: Will not fix
Red Hat Satellite 6AffectedNo fix yet
Not affected: 1 product
  • Red Hat 3scale API Management Platform 2

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-122006
  2. 2026-11-04 Alias added: GHSA-wgv4-95jc-33jm
  3. 2026-11-05 Affected versions changed · Red Hat
  4. 2026-11-05 CVSS score added · Red Hat
  5. 2026-11-06 Affected versions changed · Red Hat

References

Other 3

  • TI-2014-00124 Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the… KEVCVSS 3.1HIGH 7.5
  • TI-2019-03828 Path traversal in Rails https://github.com/rails/rails KEVCVSS 3.1HIGH 7.5
  • TI-2016-00672 Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x… KEVCVSS 3.1HIGH 7.5
  • TI-2019-03830 Command injection in Rails https://github.com/rails/rails CVSS 3.1CRITICAL 9.8
  • TI-2026-47043 Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing CVSS 4.0CRITICAL 9.5
  • TI-2025-18040 Command injection in Rails activestorage CVSS 4.0CRITICAL 9.2
See all 163 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences