rubyonrails Active Storage: critical vulnerability

rubyonrails Active Storage

The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.

Do this now

Check the advisory for a fix and restrict access to Active Storage meanwhile.

First seen: 5 Nov 2026
Last update: 5 Nov 2026, 08:18 UTC
Versions per the CVE record from mitre, not the vendor: 8.1.4.1
8.0.5.2
Identifiers: CVE-2026-122006
CVSS: 9.8
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## rubyonrails Active Storage: critical vulnerability
Severity: critical. Patch status: fix status unknown.
Affected: rubyonrails Active Storage
Versions per the CVE record from mitre, not the vendor: 8.1.4.1, 8.0.5.2
Ids: CVE-2026-122006

The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.

## Steps
1. Search the repo, its CI and infra config for rubyonrails Active Storage. If present, report the version in use and whether it's affected.
2. Versions per the CVE record from mitre, not the vendor: Active Storage: 8.1.x → 8.1.4.1; 8.0.5.2. Don't treat them as a fix until the vendor says so.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Active Storage 8.1.x | per the CVE record from mitre, not the vendor | 8.1.4.1 | restrict network access to it |
| Active Storage | per the CVE record from mitre, not the vendor | 8.0.5.2 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-122006") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/rails/rails/releases/tag/v8.0.5.2 https://nvd.nist.gov/vuln/detail/CVE-2026-122006
https://pwned.coffee/i/the-activestorage-gem-before-8-1-4-1-for-ruby-on-rails-w-cve-2026-122006

Receipt

Exploitation: No known exploitation
By release line, per the CVE record from mitre, not the vendor: Product Affected Version named Source
Active Storage 8.1 to before 8.1.4.1 8.1.4.1 CVE record (CNA) per the CVE record from mitre, not the vendor checked 6 Nov
Active Storage before 8.0.5.2 8.0.5.2 CVE record (CNA) per the CVE record from mitre, not the vendor checked 6 Nov
Score: CVSS 9.8 (critical). CVSS 3.1 9.8 (CNA mitre) for CVE-2026-122006
Last checked: 6 Nov 2026, 12:18 UTC

Product	Affected	Version named	Source
Active Storage	8.1 to before 8.1.4.1	8.1.4.1	CVE record (CNA) per the CVE record from mitre, not the vendor checked 6 Nov
Active Storage	before 8.0.5.2	8.0.5.2	CVE record (CNA) per the CVE record from mitre, not the vendor checked 6 Nov

Sources: KEV – CVE record ✓ Vendor –

Sources

Follow on X

Totalone very hot coffee