Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
🆕 New CVE rubyonrails Active Storage: file read and write via attachment image processing (CVE-2026-122006) Unauthenticated remote attackers can read and write server files, including secret_key_base, via image attachments. Patch → 8.0.5.2, 8.1.4.1 https://cve.now/CVE-2026-122006?utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=critical
Ruby on Rails 8.1.4.1 and 8.0.5.2 fix 21 vulnerabilities, one critical. CVE-2026-122006 (CVSS 9.8) in Active Storage with ImageMagick allows arbitrary file writes from crafted uploads. Additional issues enable RCE, file reads, XSS, and DoS. 8.0 branch ends security support on 7 November. #ThreatIntel #CVE #Rails
🚨 CVE-2026-122006 (CVSS 9.8 Critical) An ActiveStorage ImageMagick processing flaw in Ruby on Rails allows unauthenticated remote attackers to read secret_key_base and achieve server RCE. ⚡ Action: Upgrade activestorage to >= 8.1.4.1. 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-122006/ https://t.co/oZtv6oDFKL
CVE-2026-122006 Rails activestorageにCVSS 9.8（v3.1・v4.0未公開）。ImageMagickで添付を処理する構成で、secret_key_baseなどを読み書きされる恐れ。8.0.5.2／8.1.4.1へ更新を。 https://nvd.nist.gov/vuln/detail/CVE-2026-122006 https://t.co/gojn5vslB7
🚨 CRITICAL - Arbitrary File Read/Write in Ruby on Rails Active Storage (CVE-2026-122006) A critical vulnerability in Ruby on Rails' activestorage gem allows unauthenticated remote attackers to trigger arbitrary server read and write operations (such as exfiltrating secret_key_base). The flaw occurs during ImageMagick attachment analysis due to the absence of a restrictive ImageMagick security policy blocking unintended file operations. 👉 Affected: activestorage < 8.0.5.2 and 8.1.x < 8.1.4.1 | Upgrade to v8.0.5.2 or v8.1.4.1 immediately (or enforce strict ImageMagick policy delegates/temporary mitigations)
Rails Active Storage flaw: one upload can leak secret_key_base CVE-2026-122006 (CVSS 9.8): with ImageMagick, a crafted attachment allows unauthenticated file write, and read on Disk storage. Fixed in 8.1.4.1/8.0.5.2. Exploitation not stated. https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9 #Rails #CVE https://t.co/G29ApLCciW