GHSA-wgv4-95jc-33jmCriticalCVSS 9.8
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing...
🔗 CVE IDs covered (1)
📋 Description
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.
🔗 References (8)
- https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9
- https://nvd.nist.gov/vuln/detail/CVE-2026-122006
- https://github.com/rails/rails/releases/tag/v8.0.5.2
- https://github.com/rails/rails/releases/tag/v8.1.4.1
- https://github.com/digitalocean/droplet-1-clicks/pull/488
- https://github.com/rubysec/ruby-advisory-db/pull/1300
- https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-11-04/TIER_2_CVE-2026-122006.md
- https://github.com/advisories/GHSA-wgv4-95jc-33jm