International
The Morning Dev

Only the news worth knowing

‹
 
A65/100

Vulnerability · critical · CVSS 9.8

Active Storage arbitrary file write and read flaw in image analysis (CVE-2026-122006)

Tier A · Patch today – Before you go home

Who’s exposed: Rails apps processing attachments with ImageMagick; Disk-service apps also exposed to file reads

Tier A because: Core infrastructure or popular tool AND remote, no login AND full takeover

Reach

Attack

Damage

Fix

Popular tool · Remote, no login · Full takeover

What to do

  1. Check the advisory at https://github.com/advisories/GHSA-f3w6-w445-fwh9 for affected and patched versions and upgrade Active Storage accordingly

The Brief

  • GitHub Advisory Database published an advisory on 2026-11-13 for CVE-2026-122006 in Active Storage, Rails' file attachment library.
  • A Rails application that processes attachments with ImageMagick may allow an unauthenticated attacker to write arbitrary files on the server.
  • When attachments are stored with the Disk service, the flaw may also let an attacker read arbitrary files readable by the application.

Why it matters

Applications that process uploaded images through Active Storage with ImageMagick could let unauthenticated attackers write and read server files, which can lead to full compromise of the application host.

The checklist behind the tier

Checklist · 4 of 10 yes
YesHits tech teamsRails Active Storage framework, which developers build and run web applications with.
NoCore infrastructureA single web framework component, not software nearly every team runs such as OpenSSH or the Linux kernel.
YesPopular toolRails is a widely used mainstream web framework, and Active Storage is a standard part of it.
NoExploited in the wildGitHub Advisory Database: describes possible arbitrary file write and read; reports no observed attacks.
NoPublic exploitGitHub Advisory Database: only an advisory is cited; no exploit code or PoC is mentioned.
YesRemote, no loginCVSSCVE-2026-122006: CVSS 9.8 – network, no privileges, no user interaction
YesFull takeoverCVSSCVE-2026-122006: CVSS rates confidentiality and integrity impact high
NoSecrets exposedGitHub Advisory Database: says arbitrary files may be readable; does not report any data actually stolen.
NoSupply chainGitHub Advisory Database: a vulnerability in Active Storage, not compromised packages or build pipelines.
NoNo fix yetGitHub AdvisoryGitHub Advisory: activestorage fixed in 8.1.4.1

The official record

From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.

  • CVE-2026-122006 ↗CVSS 9.8 critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

    The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick securit

    Exploited
    Not in CISA’s exploited catalog
    EPSS
    <1% chance of exploitation in the next 30 days · higher than 55% of all CVEs
    Fix
    • activestorage (rubygems) fixed in 8.1.4.1
    • activestorage (rubygems) fixed in 8.0.5.2
    Weakness
    CWE-1188

    NVDGHSA-f3w6-w445-fwh9

Timeline

  1. GitHub Advisory Database

    Active Storage: Possible arbitrary file write and read in image analysis (CVE-2026-122006)

  2. GitHub Advisory Database publishes advisory GHSA-f3w6-w445-fwh9 for the Active Storage flaw

Source

Active Storage: Possible arbitrary file write and read in image analysis (CVE-2026-122006) ↗ GitHub Advisory Database · 2h ago

First seen · 1 source · Full story page · How tiers are decided