How do I check whether I am affected by CVE-2026-122006?

- Check Gemfile.lock or run 'bundle exec gem list activestorage': affected is = 8.1, < 8.1.4.1. - Affected only if ALL hold: config.active_storage.variant_processor = :mini_magick (default for apps on load_defaults 6.1 or earlier); ImageMagick runs under a policy that does not deny the MSL/Ghostscript/file coders (Debian and Ubuntu packaged policies do not); the app accepts uploads from untrusted users. - Attaching the file is enough; no variant, preview or analyze call is needed. - Also check if you use ImageMagick via MiniMagick outside Active Storage: the fixed policy applies to every MiniMagick process, and apps that replace MiniMagick.cli_env, set cli_prefix or use a custom MiniMagick::Shell, or GraphicsMagick, do not get the shipped policy. - If Disk service was used, assume secret_key_base may have been read.

What is the fix for CVE-2026-122006?

Upgrade activestorage (Rails) to 8.1.4.1 (8.1 line) or 8.0.5.2 (8.0 line). Apps with variant_processor :mini_magick need mini_magick >= 5.1 or boot raises. If you render PS/PDF via ImageMagick, re-allow the gs delegate in policy.xml. If attachments use the Disk service, rotate secret_key_base and every secret the app process can read (master key, credentials.yml.enc contents, DB/storage creds, third-party tokens). Workaround if you cannot upgrade: copy the rules from activestorage/lib/active_storage/image_magick/policy.xml into the system ImageMagick policy.xml (at minimum deny coder MSL, the Ghostscript coders PS/EPS/PDF/XPS/PCL etc., and delegate gs).

Post Share

CRITICAL9.8CVSS · [email protected]

NO KNOWN
EXPLOIT

ACTIVESTORAGE · CVE-2026-122006 · Package

Rails ActiveStorage: ImageMagick attachments let an attacker read and write server files

Q: What is the fix for CVE-2026-122006?

Upgrade activestorage (Rails) to 8.1.4.1 (8.1 line) or 8.0.5.2 (8.0 line). Apps with variant_processor :mini_magick need mini_magick >= 5.1 or boot raises. If you render PS/PDF via ImageMagick, re-allow the gs delegate in policy.xml. If attachments use the Disk service, rotate secret_key_base and every secret the app process can read (master key, credentials.yml.enc contents, DB/storage creds, third-party tokens). Workaround if you cannot upgrade: copy the rules from activestorage/lib/active_storage/image_magick/policy.xml into the system ImageMagick policy.xml (at minimum deny coder MSL, the Ghostscript coders PS/EPS/PDF/XPS/PCL etc., and delegate gs).

Q: Who is not affected by CVE-2026-122006?

Not affected if: activestorage-8.0.5.2-or-later, activestorage-8.1.4.1-or-later, libvips-processor, no-imagemagick-processing, no-untrusted-uploads.

FIX → 8.0.5.2 · 8.1.4.1 ✓ verified

The activestorage gem before 8.1.4.1 runs the ImageMagick analyzer when a file is attached, and no ImageMagick security policy blocks unintended ImageMagick functions. An attacker who can upload an image can make the server read and write files, such as the secret_key_base.

first public Nov 4, 2026 · 2 sources

Running Activestorage? Find out in 2 minutes.

Tell InfraStack what you run. It checks this one, and every next one, against your stack.

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

In Slack

Run the check

01 · Who is affected

✓ Verified Nov 4

Rails apps that process Active Storage attachments with ImageMagick (variant_processor :mini_magick, the default for load_defaults 6.1 or earlier) on activestorage < 8.0.5.2 or >= 8.1 and < 8.1.4.1, under an ImageMagick policy that does not already deny the risky coders (Debian/Ubuntu defaults do not), and that accept uploads from untrusted users. Per the vendor, an unauthenticated attacker can write arbitrary files and, with the Disk service, read files such as secret_key_base, which can lead to remote code execution. Apps using libvips, no ImageMagick, or no untrusted uploads can skip it.

activestorage< 8.0.5.2, >= 8.1, < 8.1.4.1fixed in 8.0.5.2, 8.1.4.1

Not affected if activestorage-8.0.5.2-or-later, activestorage-8.1.4.1-or-later, libvips-processor, no-imagemagick-processing, no-untrusted-uploads

Who cares activestorage, imagemagick, mini_magick, rails, ruby, self-hosted, unauthenticated

02 · How to check

✓ Verified Nov 4

Check Gemfile.lock or run 'bundle exec gem list activestorage': affected is < 8.0.5.2 or >= 8.1, < 8.1.4.1.
Affected only if ALL hold: config.active_storage.variant_processor = :mini_magick (default for apps on load_defaults 6.1 or earlier); ImageMagick runs under a policy that does not deny the MSL/Ghostscript/file coders (Debian and Ubuntu packaged policies do not); the app accepts uploads from untrusted users.

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 4, 2026

How it unfolded

3 events · Nov 4, 2026 → Nov 4, 2026

Nov 4, 202603:09 UTCgithub.com Vendor advisory: github.com
Nov 4, 202615:27 UTCNVD CVE-2026-122006
Nov 4, 202615:29 UTCInfraStack Analyst Read GHSA-f3w6-w445-fwh9 and 8.0.5.2 release notes. Unauthenticated per vendor (upload must reach attach); fixed 8.0.5.2/8.1.4.1; reporter ryotak. NVD text says only 'before 8.1.4.1', vendor also lists 8.0 line. No exploitation or PoC checked/seen; older Rails lines unstated by vendor.

Get the next Activestorage threat the day it hits your stack.

Start watching free

Post Share

CRITICAL9.8CVSS · [email protected]

NO KNOWN
EXPLOIT

ACTIVESTORAGE · CVE-2026-122006 · Package

Rails ActiveStorage: ImageMagick attachments let an attacker read and write server files

FIX → 8.0.5.2 · 8.1.4.1 ✓ verified

first public Nov 4, 2026 · 2 sources

Running Activestorage? Find out in 2 minutes.

Tell InfraStack what you run. It checks this one, and every next one, against your stack.

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

In Slack

Run the check

01 · Who is affected

✓ Verified Nov 4

activestorage< 8.0.5.2, >= 8.1, < 8.1.4.1fixed in 8.0.5.2, 8.1.4.1

Not affected if activestorage-8.0.5.2-or-later, activestorage-8.1.4.1-or-later, libvips-processor, no-imagemagick-processing, no-untrusted-uploads

Who cares activestorage, imagemagick, mini_magick, rails, ruby, self-hosted, unauthenticated

02 · How to check

✓ Verified Nov 4

Check Gemfile.lock or run 'bundle exec gem list activestorage': affected is < 8.0.5.2 or >= 8.1, < 8.1.4.1.
Affected only if ALL hold: config.active_storage.variant_processor = :mini_magick (default for apps on load_defaults 6.1 or earlier); ImageMagick runs under a policy that does not deny the MSL/Ghostscript/file coders (Debian and Ubuntu packaged policies do not); the app accepts uploads from untrusted users.

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 4, 2026

How it unfolded

3 events · Nov 4, 2026 → Nov 4, 2026

Nov 4, 202603:09 UTCgithub.com Vendor advisory: github.com
Nov 4, 202615:27 UTCNVD CVE-2026-122006
Nov 4, 202615:29 UTCInfraStack Analyst Read GHSA-f3w6-w445-fwh9 and 8.0.5.2 release notes. Unauthenticated per vendor (upload must reach attach); fixed 8.0.5.2/8.1.4.1; reporter ryotak. NVD text says only 'before 8.1.4.1', vendor also lists 8.0 line. No exploitation or PoC checked/seen; older Rails lines unstated by vendor.

Get the next Activestorage threat the day it hits your stack.

Start watching free

Rails ActiveStorage: ImageMagick attachments let an attacker read and write server files

01 · Who is affected

02 · How to check

How it unfolded

Read next

Get the next Activestorage threat the day it hits your stack.

Rails ActiveStorage: ImageMagick attachments let an attacker read and write server files

01 · Who is affected

02 · How to check

How it unfolded

Read next

Get the next Activestorage threat the day it hits your stack.

03 · The fix

What the sources say, verbatim

Sources and references