CVE-2026-126082

Summary

A flaw in Active Storage's ImageMagick integration (CWE-1188) allows unauthenticated attackers to trigger arbitrary file read/write operations by uploading a specially crafted image that exploits ImageMagick's coder selection behavior. This occurs because Active Storage does not restrict which ImageMagick coders are invoked during analysis, enabling attackers to leverage coders that operate on embedded filenames rather than the image itself.

Exploitability

Exploitation is straightforward for unauthenticated attackers if the application uses :mini_magick as the variant processor, runs under a permissive ImageMagick security policy, and accepts untrusted file uploads—no authentication or user interaction required.

Blast radius

Successful exploitation can lead to theft of sensitive files like secret_key_base and credentials, potentially enabling remote code execution or lateral movement into other systems connected via those credentials.

Detection

Defenders should monitor for anomalous file creation or access patterns in the application's log directory (e.g., unexpected files written under tmp/ or storage/), especially files with non-image extensions or unusual paths, and correlate with Active Storage attachment events logged by Rails; also watch for ImageMagick process spawns with suspicious command-line arguments referencing external files.

Prioritized remediation

Upgrade to Rails 8.1.4.1 or 8.0.5.2 immediately; if upgrading is not feasible, disable ImageMagick variant processing by setting config.active_storage.variant_processor = :vips or restrict ImageMagick coders via policy.xml to deny dangerous coders such as PDF, PS, SVG, and ZIP.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.