CVE-2026-122006criticalCWE-1188

CVE-2026-122006: critical vulnerability in rubyonrails Active Storage

Published · Updated

Follow this CVE+ Monitor Active Storage+ Monitor rails

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.8epss 0.7%
from disclosure to weapon1 day
Published on NVDNov 4
1st PoC+1d
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
rubyonrails · Active Storage
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.