CVE-2026-122006
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing…
- Risk score
- 64/100
- CVSS
- 9.8 v3.1
- Published
- 4 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The activestorage gem before 8.1.4.1 for Ruby on Rails allows server read and write operations when processing ImageMagick attachments, potentially exposing sensitive data.
- Affected
- {'products': ['activestorage gem'], 'packages': [], 'versions': ['before 8.1.4.1']}
- Fix
- Upgrade to version 8.1.4.1 or later
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.
Last activity 4 Nov 2026. Patch Forecast updates every hour.