# Active Storage: Possible arbitrary file write and read in image analysis (CVE-2026-122006)

Source: [GitHub Advisory Database](https://github.com/advisories/GHSA-f3w6-w445-fwh9) · 2026-11-12 · Security
Page: https://themorning.dev/story/active-storage-possible-arbitrary-file-write-and-read-in-image-analysis-cve-2026-67f8849921dc03ac
Kind: security · Impact: high

## In brief

- GitHub Advisory Database published an advisory on 2026-11-13 for CVE-2026-122006 in Active Storage, Rails' file attachment library.
- A Rails application that processes attachments with ImageMagick may allow an unauthenticated attacker to write arbitrary files on the server.
- When attachments are stored with the Disk service, the flaw may also let an attacker read arbitrary files readable by the application.

## Why it matters

Applications that process uploaded images through Active Storage with ImageMagick could let unauthenticated attackers write and read server files, which can lead to full compromise of the application host.

## What to do

- Check the advisory at https://github.com/advisories/GHSA-f3w6-w445-fwh9 for affected and patched versions and upgrade Active Storage accordingly

## CVEs

- CVE-2026-122006

## Timeline

- 2026-11-13: GitHub Advisory Database publishes advisory GHSA-f3w6-w445-fwh9 for the Active Storage flaw

## Coverage

- [Active Storage: Possible arbitrary file write and read in image analysis (CVE-2026-122006)](https://github.com/advisories/GHSA-f3w6-w445-fwh9) — GitHub Advisory Database, 2026-11-12

Tags: rails, active-storage, security, imagemagick, file-upload, cve

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev