No VulnCrest analysis published for this CVE yet. Below is the original CNA/NVD description, unmodified.
Description
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.
Exploits & detection
Exploitcharlie-goldenowl/cve-2026-122006-check · github · ★ 0 · discovered
Unreviewed third-party code. Fake PoCs often contain malware — read the code before running it.
Timeline
- Published: 04 Nov 2026
- Last modified upstream: 05 Nov 2026
Sources & licenses
- CVE / CVSS / CWE
- NVD record ↗ (unmodified). This product uses the NVD API but is not endorsed or certified by the NVD. CVE® © The MITRE Corporation.
- Exploitation
- CISA KEV (CC0) · EPSS by FIRST.org
- References used for the analysis
- https://github.com/rails/rails/releases/tag/v8.0.5.2
- https://github.com/rails/rails/releases/tag/v8.1.4.1
- https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9
- https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-11-04/TIER_2_CVE-2026-122006.md
- https://github.com/digitalocean/droplet-1-clicks/pull/488
- https://github.com/rubysec/ruby-advisory-db/pull/1300
- Analysis, summary and remediation
- © VulnCrest