Security · High impactFan score 65 · Tier A
Active Storage: Possible arbitrary file write and read in image analysis (CVE-2026-122006)
The Brief
- GitHub Advisory Database published an advisory on 2026-11-13 for CVE-2026-122006 in Active Storage, Rails' file attachment library.
- A Rails application that processes attachments with ImageMagick may allow an unauthenticated attacker to write arbitrary files on the server.
- When attachments are stored with the Disk service, the flaw may also let an attacker read arbitrary files readable by the application.
Why it matters
Applications that process uploaded images through Active Storage with ImageMagick could let unauthenticated attackers write and read server files, which can lead to full compromise of the application host.
Who’s affected
- Rails teams using Active Storage with ImageMagick image processing
- Rails applications storing attachments with the Disk service
What to do
- Check the advisory at https://github.com/advisories/GHSA-f3w6-w445-fwh9 for affected and patched versions and upgrade Active Storage accordingly
Affects activestorage. Impact A Rails application that processes attachments with ImageMagick may allow an unauthenticated attacker to write arbitrary files on the server and, when attachments are stored with the Disk service, to read arbitrary files readable by the application…
Timeline
GitHub Advisory Database
Active Storage: Possible arbitrary file write and read in image analysis (CVE-2026-122006)
GitHub Advisory Database publishes advisory GHSA-f3w6-w445-fwh9 for the Active Storage flaw