CVE-2026-122006: Unauthenticated Arbitrary File Read and Write in Ruby on Rails Active Storage via ImageMagick

Vulnerability ID: CVE-2026-122006
CVSS Score: 9.8
Published: 2026-11-12

CVE-2026-122006 is a critical vulnerability in the Ruby on Rails Active Storage framework affecting versions prior to 8.0.5.2 and 8.1.4.1. When an application processes uploaded file attachments using the ImageMagick variant processor (:mini_magick), the framework invokes ImageMagick's metadata analyzer without applying a restrictive security policy. An unauthenticated attacker can upload a crafted file containing directives for unrestricted ImageMagick coders, such as Magick Scripting Language (MSL), resulting in arbitrary server-side file read and write operations. In deployments using the Disk storage service, attackers can exfiltrate sensitive application configuration files, including secret_key_base and master encryption keys, which enables remote code execution via signed payload forgery.

TL;DR

Active Storage prior to 8.0.5.2 and 8.1.4.1 invokes ImageMagick via MiniMagick without restricting dangerous coders (such as MSL, TEXT, EPHEMERAL, and Ghostscript delegates). Uploading a malicious attachment triggers automatic metadata analysis, enabling unauthenticated arbitrary file read and write on the server.

⚠️ Exploit Status: POC

Technical Details

• CVE ID: CVE-2026-122006 (GHSA-f3w6-w445-fwh9)
• Weakness Class: CWE-1188 (Initialization of a Resource with an Insecure Default)
• Attack Vector: Network (Unauthenticated File Upload)
• CVSS v3.1 Score: 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• EPSS Score: 0.74% (55.14th Percentile)
• Primary Impact: Arbitrary File Read & Write / Secret Exfiltration / RCE
• Exploit Status: Proof-of-Concept & Detection Tooling Available
• CISA KEV Status: Not Listed

Affected Systems

• Ruby on Rails (activestorage gem < 8.0.5.2)
• Ruby on Rails (activestorage gem >= 8.1.0, < 8.1.4.1)
• activestorage: < 8.0.5.2 (Fixed in: 8.0.5.2)
• activestorage: >= 8.1.0, < 8.1.4.1 (Fixed in: 8.1.4.1)

Code Analysis

Commit: 468aa9a

Ship a restrictive ImageMagick policy.xml in Active Storage and enforce mini_magick >= 5.1 via MAGICK_CONFIGURE_PATH.

Commit: ea8c401

Backport ImageMagick security policy enforcement for Active Storage.

Exploit Details

• GitHub: Audit and detection script checking Gemfile.lock versions, variant_processor settings, and host ImageMagick policy.xml rules for CVE-2026-122006.
• HackerOne: Original vulnerability disclosure report detailing the Active Storage ImageMagick security policy bypass.

Mitigation Strategies

• Upgrade activestorage and mini_magick gems to patched releases that enforce a built-in ImageMagick security policy.
• Migrate the Active Storage variant processor from :mini_magick to :vips (libvips).
• Configure a system-wide ImageMagick policy.xml in /etc/ImageMagick-6/ or /etc/ImageMagick-7/ to disable dangerous coders (MSL, TEXT, EPHEMERAL, MPC, URL, FILE) and Ghostscript delegates.
• Rotate all application secrets (secret_key_base, master.key, database credentials) if an affected application used the Disk storage service with untrusted uploads.

Remediation Steps:

1. Update Gemfile to require activestorage >= 8.0.5.2 (for Rails 8.0.x) or >= 8.1.4.1 (for Rails 8.1.x), and ensure gem 'mini_magick', '~> 5.1' is specified.
2. Run 'bundle update activestorage mini_magick' and redeploy the application.
3. Verify the active ImageMagick policy using: bin/rails runner 'puts MiniMagick.identify { |i| i.list "policy" }'.
4. If previously exposed with the Disk storage service, rotate secret_key_base, re-encrypt credentials.yml.enc with a new master key, and invalidate active sessions.

References

• CVE-2026-122006 Official Record
• NVD Vulnerability Detail: CVE-2026-122006
• GitHub Security Advisory GHSA-f3w6-w445-fwh9
• Rails Fix Commit (main): Enforce ImageMagick security policy in Active Storage
• Rails Fix Commit (backport): Enforce ImageMagick security policy in Active Storage
• Ruby on Rails v8.0.5.2 Release
• Ruby on Rails v8.1.4.1 Release
• HackerOne Report #3904256
• Ruby Advisory Database PR #1300
• DigitalOcean Droplet 1-Clicks Update PR #488
• Alan Turing Institute Cyber Threat Observatory Report
• Community Detection Script: cve-2026-122006-check
• Threat Defence Analysis: Rails Active Storage CVE-2026-122006 Patching & Hunting

Read the full report for CVE-2026-122006 on our website for more details including interactive diagrams and full exploit analysis.