CVE-2026-122006 activestorage: activestorage: arbitrary file read and write via ImageMagick attachment analysis
CriticalCVSS 9.8
EPSS 0.74%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat/3scale-amp2/system-rhel8(Red Hat:3scale:2.13) | All versions | No fix listed |
| redhat/3scale-amp2/zync-rhel9(Red Hat:3scale:2.13) | All versions | No fix listed |
| redhat/rubygem-activestorage(Red Hat:satellite:6) | All versions | No fix listed |
| rubygems activestorage | < 8.0.5.2 | 8.0.5.2 |
| rubygems activestorage | >= 8.1, < 8.1.4.1 | 8.1.4.1 |
| debian/rails(Debian:12) | All versions | No fix listed |
| debian/rails(Debian:12) | = 2:6.1.7.10+dfsg-1~deb12u1 | No fix listed |
| debian/rails(Debian:12) | = 2:6.1.7.10+dfsg-1~deb12u2 | No fix listed |
| debian/rails(Debian:12) | = 2:6.1.7.10+dfsg-1~deb12u3 | No fix listed |
| debian/rails(Debian:12) | = 2:6.1.7.3+dfsg-1 | No fix listed |
| debian/rails(Debian:12) | = 2:6.1.7.3+dfsg-10 | No fix listed |
| debian/rails(Debian:12) | = 2:6.1.7.3+dfsg-11 | No fix listed |
| debian/rails(Debian:12) | = 2:6.1.7.3+dfsg-12 | No fix listed |
| debian/rails(Debian:12) | = 2:6.1.7.3+dfsg-13 | No fix listed |
| debian/rails(Debian:12) | = 2:6.1.7.3+dfsg-2 | No fix listed |
| debian/rails(Debian:12) | = 2:6.1.7.3+dfsg-2~deb12u1 | No fix listed |
| debian/rails(Debian:12) | = 2:6.1.7.3+dfsg-3 | No fix listed |
| debian/rails(Debian:12) | = 2:6.1.7.3+dfsg-4 | No fix listed |
| debian/rails(Debian:12) | = 2:6.1.7.3+dfsg-5 | No fix listed |
| debian/rails(Debian:12) | = 2:6.1.7.3+dfsg-6 | No fix listed |
| debian/rails(Debian:12) | = 2:6.1.7.3+dfsg-7 | No fix listed |
| debian/rails(Debian:12) | = 2:6.1.7.3+dfsg-7~exp1 | No fix listed |
| debian/rails(Debian:12) | = 2:6.1.7.3+dfsg-8 | No fix listed |
| debian/rails(Debian:12) | = 2:6.1.7.3+dfsg-9 | No fix listed |
| debian/rails(Debian:12) | = 2:7.2.2.1+dfsg-1 | No fix listed |
Show 58 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/rails(Debian:12) | = 2:7.2.2.1+dfsg-1~exp1 | No fix listed |
| debian/rails(Debian:12) | = 2:7.2.2.1+dfsg-1~exp2 | No fix listed |
| debian/rails(Debian:12) | = 2:7.2.2.1+dfsg-1~exp3 | No fix listed |
| debian/rails(Debian:12) | = 2:7.2.2.1+dfsg-1~exp4 | No fix listed |
| debian/rails(Debian:12) | = 2:7.2.2.1+dfsg-1~exp6 | No fix listed |
| debian/rails(Debian:12) | = 2:7.2.2.1+dfsg-2 | No fix listed |
| debian/rails(Debian:12) | = 2:7.2.2.1+dfsg-3 | No fix listed |
| debian/rails(Debian:12) | = 2:7.2.2.1+dfsg-4 | No fix listed |
| debian/rails(Debian:12) | = 2:7.2.2.1+dfsg-5 | No fix listed |
| debian/rails(Debian:12) | = 2:7.2.2.1+dfsg-6 | No fix listed |
| debian/rails(Debian:12) | = 2:7.2.2.1+dfsg-7 | No fix listed |
| debian/rails(Debian:12) | = 2:7.2.2.2+dfsg-1 | No fix listed |
| debian/rails(Debian:12) | = 2:7.2.2.2+dfsg-2 | No fix listed |
| debian/rails(Debian:12) | = 2:7.2.2.2+dfsg-2~deb13u1 | No fix listed |
| debian/rails(Debian:12) | = 2:7.2.2.2+dfsg-2~deb13u2 | No fix listed |
| debian/rails(Debian:12) | = 2:7.2.3+dfsg-1 | No fix listed |
| debian/rails(Debian:12) | = 2:7.2.3+dfsg-2 | No fix listed |
| debian/rails(Debian:12) | = 2:7.2.3+dfsg-3 | No fix listed |
| debian/rails(Debian:12) | = 2:7.2.3.1+dfsg-1 | No fix listed |
| debian/rails(Debian:12) | = 2:7.2.3.2+dfsg-1 | No fix listed |
| debian/rails(Debian:12) | = 2:7.2.3.2+dfsg-2 | No fix listed |
| debian/rails(Debian:12) | = 2:7.2.3.2+dfsg-3 | No fix listed |
| debian/rails(Debian:12) | = 2:7.2.4+dfsg-1 | No fix listed |
| debian/rails(Debian:12) | = 2:7.2.4+dfsg-2 | No fix listed |
| debian/rails(Debian:13) | All versions | No fix listed |
| debian/rails(Debian:13) | = 2:7.2.2.1+dfsg-7 | No fix listed |
| debian/rails(Debian:13) | = 2:7.2.2.2+dfsg-1 | No fix listed |
| debian/rails(Debian:13) | = 2:7.2.2.2+dfsg-2 | No fix listed |
| debian/rails(Debian:13) | = 2:7.2.2.2+dfsg-2~deb13u1 | No fix listed |
| debian/rails(Debian:13) | = 2:7.2.2.2+dfsg-2~deb13u2 | No fix listed |
| debian/rails(Debian:13) | = 2:7.2.3+dfsg-1 | No fix listed |
| debian/rails(Debian:13) | = 2:7.2.3+dfsg-2 | No fix listed |
| debian/rails(Debian:13) | = 2:7.2.3+dfsg-3 | No fix listed |
| debian/rails(Debian:13) | = 2:7.2.3.1+dfsg-1 | No fix listed |
| debian/rails(Debian:13) | = 2:7.2.3.2+dfsg-1 | No fix listed |
| debian/rails(Debian:13) | = 2:7.2.3.2+dfsg-2 | No fix listed |
| debian/rails(Debian:13) | = 2:7.2.3.2+dfsg-3 | No fix listed |
| debian/rails(Debian:13) | = 2:7.2.4+dfsg-1 | No fix listed |
| debian/rails(Debian:13) | = 2:7.2.4+dfsg-2 | No fix listed |
| debian/rails(Debian:14) | All versions | No fix listed |
| debian/rails(Debian:14) | = 2:7.2.2.1+dfsg-7 | No fix listed |
| debian/rails(Debian:14) | = 2:7.2.2.2+dfsg-1 | No fix listed |
| debian/rails(Debian:14) | = 2:7.2.2.2+dfsg-2 | No fix listed |
| debian/rails(Debian:14) | = 2:7.2.2.2+dfsg-2~deb13u1 | No fix listed |
| debian/rails(Debian:14) | = 2:7.2.2.2+dfsg-2~deb13u2 | No fix listed |
| debian/rails(Debian:14) | = 2:7.2.3+dfsg-1 | No fix listed |
| debian/rails(Debian:14) | = 2:7.2.3+dfsg-2 | No fix listed |
| debian/rails(Debian:14) | = 2:7.2.3+dfsg-3 | No fix listed |
| debian/rails(Debian:14) | = 2:7.2.3.1+dfsg-1 | No fix listed |
| debian/rails(Debian:14) | = 2:7.2.3.2+dfsg-1 | No fix listed |
| debian/rails(Debian:14) | = 2:7.2.3.2+dfsg-2 | No fix listed |
| debian/rails(Debian:14) | = 2:7.2.3.2+dfsg-3 | No fix listed |
| debian/rails(Debian:14) | = 2:7.2.4+dfsg-1 | No fix listed |
| debian/rails(Debian:14) | = 2:7.2.4+dfsg-2 | No fix listed |
| ubuntu/rails(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/rails(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/rails(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/rails(Ubuntu:26.10) | All versions | No fix listed |
References
- Red Hat CVE page mitigation vendor-advisory
- Red Hat Bugzilla 2566942 issue-tracking
- www.cve.org
- nvd.nist.gov
- github.com
- github.com
- github.com
- github.com
- github.com
- github.com
- Debian Security Tracker CVE-2026-122006 vendor-advisory
- Ubuntu CVE tracker vendor-advisory