CVE-2026-122006

Summary

The activestorage gem before 8.1.4.1 for Ruby on Rails allows arbitrary file read and write operations via ImageMagick attachment processing because the analyzer runs during file attachment without a security policy to restrict dangerous ImageMagick features, potentially exposing secrets like secret_key_base.

Exploitability

Exploitation requires an attacker to upload a maliciously crafted image file that triggers unsafe ImageMagick functionality; no authentication or user interaction is needed.

Blast radius

Successful exploitation could lead to full system compromise including credential theft, remote code execution via file writes, and complete data breach of the application and underlying infrastructure.

Detection

Look for anomalous ImageMagick log entries indicating use of restricted coders (e.g., 'file:', 'http:', 'https:') or execution of non-whitelisted delegates; also monitor for unexpected reads of sensitive files (e.g., config files, environment variables) by the Rails application process during ActiveStorage processing.

Prioritized remediation

Upgrade to activestorage gem version 8.1.4.1 or later, and ensure an ImageMagick security policy is configured to block unsafe operations such as file:// access and shell command invocation.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.