Rails Active Storage Flaw CVE-2026-122006: Patch Now

A critical flaw in Ruby on Rails' Active Storage library lets an unauthenticated attacker write — and potentially read — arbitrary files on a vulnerable server simply by uploading a crafted image, no account or special access required. The bug, tracked as CVE-2026-122006 (GitHub Security Advisory GHSA-f3w6-w445-fwh9), carries a maximum-severity CVSS score of 9.8 and was disclosed by the Rails security team on November 4, 2026, alongside patched releases 8.0.5.2 and 8.1.4.1. Any Rails app that processes uploaded images through Active Storage's ImageMagick (:mini_magick) variant processor and accepts files from untrusted users should treat this as a drop-everything, patch-today issue.

What happened

The Rails security team published the advisory for GHSA-f3w6-w445-fwh9, titled "Possible arbitrary file write and read in Active Storage image analysis," as part of a bundle of 21 security fixes shipped in Rails 8.0.5.2 and 8.1.4.1. Of the 21, this one stands out: it is the only issue in the batch rated Critical, and it is the only one with a published CVSS score of 9.8. The National Vulnerability Database entry for CVE-2026-122006 describes the issue as allowing "server read and write operations" when ImageMagick processes an attached file, and specifically calls out exposure of secret_key_base as an example of what an attacker could pull off a vulnerable box.

That detail matters because secret_key_base underpins session integrity and signed/encrypted cookies in a Rails app. A leaked value, combined with other application secrets an attacker can read off disk, can be a direct path to remote code execution or broader compromise — not just a nuisance file-write bug.

How the attack works

Active Storage, Rails' built-in file-attachment framework, runs an image analyzer automatically whenever a file is attached — before any developer code calls variant, preview, or analyze. If an application configures config.active_storage.variant_processor = :mini_magick (the default under load_defaults 6.1 or earlier), that automatic analysis pass hands the uploaded file straight to ImageMagick.

ImageMagick's design is the root of the problem: it picks a decoder ("coder") based on the content it sniffs inside a file, not the file's extension. Several of ImageMagick's built-in coders are intentionally powerful — some can read or delete arbitrary files named inside the image data, fetch remote or local URLs, or hand off processing to a Ghostscript delegate. According to the advisory, Active Storage shipped without any restriction on which of these coders ImageMagick was allowed to use. A file that merely looks like an image to a human, and that an attacker can upload through any public form, variant endpoint, or direct-upload flow, is enough to trigger the automatic analyzer and reach one of these dangerous coders — no extra step, no authentication, and no reliance on a developer explicitly calling into image processing.

The advisory is careful to note that the researcher demonstrated one exploitation chain, but Rails maintainers "do not assume it is the only one" — a sign the underlying design flaw (an unrestricted ImageMagick policy) could be exploited in more than one way.

Who is affected

Per the GitHub advisory, an application is exposed if it meets all three conditions:

• It sets Active Storage's variant processor to :mini_magick — the default for apps generated before Rails loaded 6.1-era defaults, so plenty of older, unmigrated codebases carry this setting without anyone having deliberately chosen it.
• Its host runs ImageMagick under a policy that doesn't already lock down the coders in question. The advisory specifically says the default ImageMagick policies shipped with Debian and Ubuntu do not block them, which covers a large share of production Rails deployments.
• It accepts file uploads from users who aren't fully trusted — in practice, almost any public-facing app with avatar uploads, document attachments, or user-generated image content.

Rails applications that instead configure :vips (libvips) as the variant processor sit on a different code path and are not described as affected by this particular advisory. That's a meaningful distinction for anyone trying to triage quickly: the processor setting in config/environments/*.rb or config/application.rb is the first thing to check.

Rails' own release notes add a deadline that raises the urgency for teams still on the 8.0 line: security support for Rails 8.0 ends November 7, 2026, just days after this release. Teams that can't move to 8.1.4.1 immediately should at minimum apply 8.0.5.2 before that support window closes, similar to the patch-now urgency around other recent framework flaws like the PHP RCE pair patched earlier this year.

What the fix actually does

Rather than simply patching one exploitation path, the fixed versions ship a bundled ImageMagick security policy and wire it in through MiniMagick.cli_env, so every ImageMagick process that MiniMagick spawns — not just the ones Active Storage triggers — picks it up via the MAGICK_CONFIGURE_PATH environment variable. That shipped policy, according to the advisory, blocks:

• The MSL scripting coder
• Coders capable of reading or deleting files other than the image itself
• Remote- and local-fetch coders
• Display coders
• Ghostscript-backed coders and the gs delegate
• @filename indirection, where a value is read in from another file on disk

Rails designed the shipped policy to add to whatever system-level ImageMagick policy already exists on the host, rather than replace it — so it layers defense-in-depth on top of, rather than instead of, proper server hardening.

Not the same bug as July's libvips flaw

It's worth being precise here, because the two issues are easy to conflate: this is a different vulnerability from CVE-2026-66066, the Active Storage flaw nicknamed "KindaRails2Shell" that Rails patched back on July 29, 2026 in versions 7.2.3.2, 8.0.5.1, and 8.1.3.1. That earlier bug involved Active Storage's libvips-based variant processing path and arbitrary file read. CVE-2026-122006 is a separate root cause tied specifically to ImageMagick's coder handling in the :mini_magick processor path, disclosed more than three months later. Teams that already patched for the July libvips issue are not automatically protected against this new ImageMagick-related one, and vice versa — the two need to be tracked and patched independently.

Part of a busier-than-usual year for Active Storage

CVE-2026-122006 is not an isolated incident — Active Storage has had a rough 2026. Earlier in the year, Rails patched CVE-2025-24293, a command-injection issue tied to the image_processing gem and mini_magick allowing unsafe transformation methods; then, in March, a batch of fixes covered a path-traversal bug in DiskService#path_for (CVE-2026-33195) and a direct-upload metadata bypass that could skip content-type checks (CVE-2026-33173). In July came CVE-2026-66066, the libvips-based file-read bug discussed above. And in this same November 4 release that fixes CVE-2026-122006, Rails also closed a separate High-severity Active Storage bug (GHSA-v924-7rp8-4mxh) covering file read and possible remote code execution in video previews, analysis, and image processing, plus several Medium- and Low-severity Active Storage issues around proxy-mode streaming, Google Cloud Storage direct uploads, and filename handling — a full list the Rails security advisories index tracks alongside every other framework CVE.

Taken together, the pattern points to a component that does a lot of implicit, automatic work — fetching, decoding, and transforming whatever a user uploads — which is exactly the kind of surface that tends to accumulate security findings once it gets serious researcher attention. If your application leans on Active Storage for anything beyond simple local-disk storage of pre-validated files, it's worth budgeting time to stay current with Rails security releases generally, not just reacting to the critical ones.

Who found it

The GitHub advisory credits the discovery to a HackerOne researcher using the handle ryotak (GitHub: Ry0taK), who reported the issue through Rails' responsible-disclosure process. The advisory does not describe a public proof-of-concept as available at time of publication, though as with most widely covered Rails CVEs, that typically changes within days to weeks of disclosure as researchers reverse-engineer the patch diff.

How to protect your app right now

If you run Rails and accept file uploads, treat this the same way you'd treat any other critical, unauthenticated, remotely exploitable framework bug — on the same priority tier as the GitLab RCE flaw CISA flagged for active exploitation earlier this year.

1. Upgrade Active Storage / Rails to 8.0.5.2 or 8.1.4.1, whichever line you're on. This is the primary fix and should happen before anything else.
2. Upgrade the mini_magick gem to 5.1 or later if your app uses the :mini_magick variant processor — older mini_magick versions will raise an exception at boot once the Rails-side fix is in place, so this isn't optional if you're staying on that processor.
3. If you can't upgrade immediately, the advisory describes a stopgap: manually copy the coder-blocking rules from Active Storage's shipped policy.xml into your host's system ImageMagick policy (for example, /etc/ImageMagick-7/policy.xml), at minimum denying the MSL coder, the Ghostscript coders, and the gs delegate. Note this doesn't help if you're on GraphicsMagick instead of ImageMagick, since GraphicsMagick doesn't read ImageMagick's policy files.
4. If you render PDFs or PostScript through ImageMagick on purpose, you'll need to deliberately re-allow the gs delegate and the specific coders your app depends on after patching, since the shipped policy blocks them by default.
5. Check for custom MiniMagick setup. Apps that override MiniMagick.cli_env after boot, clear environment variables via MiniMagick.cli_prefix, or define a custom MiniMagick::Shell won't automatically inherit the new policy and need to add equivalent rules themselves.
6. Rotate secrets if you use the Disk service. Because this bug could allow arbitrary file reads in Disk-service configurations, the advisory recommends rotating secret_key_base, the Rails master key, and any storage, database, or third-party credentials the application process could read — on the assumption that a sufficiently motivated attacker had a window to exploit this before you patched.

None of this requires exotic tooling to check. A quick audit of config.active_storage.variant_processor across your codebase, your current Rails and mini_magick gem versions, and your ImageMagick policy.xml will tell you in a few minutes whether you're exposed.

The bottom line

An unauthenticated, CVSS 9.8 file-write-and-potentially-read bug reachable through routine image uploads — with no developer code required beyond having Active Storage attach the file — is about as serious as web-framework vulnerabilities get. The fact that it ships bundled with 20 other fixes, including a separate High-severity Active Storage video/image-processing RCE path (GHSA-v924-7rp8-4mxh) in the same release, only adds to the case for upgrading the whole dependency rather than cherry-picking a single patch. Treat this release the way you'd treat the recent run of critical infrastructure CVEs covered on this desk, from Nextcloud's code-server flaw to the VMware vCenter RCE bug: patch first, audit configuration second, and don't assume a narrow read of "we don't use that feature" makes you safe when the vulnerable code runs automatically on attach.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage