{"slug":"rails-active-storage-imagemagick-cve-2026-122006","title":"Rails Active Storage ImageMagick file write/read (possible RCE), CVE-2026-122006","shortName":"Rails Active Storage","seoTitle":"Rails Active Storage (CVE-2026-122006): versions, exploitation & detection","summary":"Possible RCE, depending on the deployment: Active Storage can write files as the app user (and read them with Disk storage) when untrusted users can attach uploads, variant_processor is :mini_magick, and the host ImageMagick policy allows the coders involved (CVE-2026-122006). Auth depends on the app's upload exposure; this is not a claim that every Rails app accepts unauthenticated uploads. GHSA CVSS 3.0 9.8 and MITRE CNA CVSS 3.1 9.8. Fixed in activestorage 8.0.5.2 and 8.1.4.1 (4 Nov 2026). With the fix, mini_magick must be 5.1 or later or the app fails to boot. Not in CISA KEV (catalog 2026.11.04, checked 5 Nov 2026). Badge: No known ITW. Pruva REPRO-2026-00389 reports lab RCE that needed Rails development defaults (code reloading); that is not production exploitation.","isExample":false,"draft":false,"family":"rails-active-storage-imagemagick-cve-2026-122006","kind":"framework","aliases":["CVE-2026-122006","GHSA-f3w6-w445-fwh9","Rails Active Storage ImageMagick","Active Storage file write/read"],"publishedAt":"2026-11-04","updatedAt":"2026-11-04","patchStatus":"patched","exploited":false,"scores":{"cve":"CVE-2026-122006","cvss":{"cve":"CVE-2026-122006","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1","scorer":"cna","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-122006","sourceDate":"2026-11-04","checkedDate":"2026-11-05","dateLabel":"CNA published","sourceLabel":"MITRE CNA (CVSS 3.1 9.8). NVD API 5 Nov 2026: Received, Secondary CNA metric; no NVD-produced Primary. GHSA-f3w6-w445-fwh9 also scores CVSS 3.0 9.8.","nvdPublishedDate":"2026-11-04"},"epss":{"cve":"CVE-2026-122006","score":0.0069,"percentile":0.52942,"date":"2026-11-05","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-122006","checkedDate":"2026-11-05"},"kev":{"cve":"CVE-2026-122006","listed":false,"dateAdded":null,"dueDate":null,"catalogVersion":"2026.11.04","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-11-05"},"addedDate":"2026-11-04"},"priority":{"label":"high"},"managementSummary":{"what":"Possible RCE, depending on the deployment: Active Storage can write files as the app user (and read them with Disk storage) when untrusted users can attach uploads, variant_processor is :mini_magick, and the host ImageMagick policy allows the coders involved (CVE-2026-122006). Auth depends on who can attach uploads. Not in CISA KEV (checked 5 Nov 2026). No known ITW as of 5 Nov 2026. Pruva reports lab RCE that needed Rails development defaults (code reloading); that is not production exploitation.","action":"Upgrade activestorage to 8.0.5.2 or 8.1.4.1 and mini_magick to 5.1 or later. Confirm the restrictive ImageMagick policy actually loads, or apply the vendor's policy rules at host level. Restrict untrusted attachments. If Disk storage could have exposed secrets, rotate signing and encryption secrets and reachable database, storage, and third-party credentials, and do not keep exposed secrets as fallbacks."},"whatChanged":{"date":"2026-11-04","items":[{"text":"New catalog page for Rails Active Storage ImageMagick file write/read (possible RCE), CVE-2026-122006 / GHSA-f3w6-w445-fwh9.","headline":"New catalog page for Rails Active Storage CVE-2026-122006","section":"overview","date":"2026-11-04","kind":"page"},{"text":"Rails published GHSA-f3w6-w445-fwh9 and released activestorage 8.0.5.2 and 8.1.4.1 on 4 Nov 2026. Affected: activestorage before 8.0.5.2, and 8.1.x before 8.1.4.1, when variant_processor is :mini_magick (the default for load_defaults 6.1 or earlier), the host ImageMagick policy permits the dangerous coders, and untrusted users can attach uploads.","headline":"Rails 8.0.5.2 and 8.1.4.1 fix the ImageMagick attach path","section":"fixed-versions","date":"2026-11-04","sourceUrl":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","alsoSourceUrl":"https://rubyonrails.org/2026/11/4/Rails-8.0.5.2-and-8.1.4.1-have-been-released"},{"text":"No known in-the-wild use as of 5 Nov 2026; first disclosed 4 Nov 2026. Pruva REPRO-2026-00389 (published 4 Nov 2026) reports lab RCE that needed Rails development defaults (code reloading), which is independent lab validation, not production exploitation.","headline":"No known ITW; Pruva lab RCE is deployment-specific; not in KEV","section":"exploitation","date":"2026-11-04","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","alsoSourceUrl":"https://www.pruva.dev/reproductions/REPRO-2026-00389"}]},"whatTheBugIs":"CVE-2026-122006 is possible arbitrary file write and read in Active Storage image analysis. Rails published GHSA-f3w6-w445-fwh9 on 4 Nov 2026. MITRE published the CVE the same day at 14:12 UTC (reserved the same minute). CWE-1188. Possible RCE is a deployment caveat, not a universal outcome. Auth depends on the app's upload exposure; this page does not claim every Rails app accepts unauthenticated uploads.\n\nGHSA: a Rails application that processes attachments with ImageMagick may allow an attacker who can attach an upload to write arbitrary files on the server and, when attachments are stored with the Disk service, to read arbitrary files readable by the application process. Those files typically include secret_key_base and credentials for external systems, which may in turn allow escalation to remote code execution or lateral movement. Attaching the upload is enough; no variant, preview, or analyze call is required. This page stays high level. It does not describe coder-chain mechanics, payloads, or reproduction steps.\n\nAn application is affected only when all of these hold, from the GHSA. variant_processor is :mini_magick, which is the default for load_defaults 6.1 or earlier. ImageMagick runs under a security policy that does not already deny the involved coders; the policies that Debian and Ubuntu package do not. Untrusted users can attach uploads. Rails 8.0.5.2 and 8.1.4.1 (Mike Dalessio, 4 Nov 2026) are the fixed gems. Older unsupported series get no fixed gem; the Rails release post recommends upgrading to at least the 8.0 series, and the GHSA workaround is the host ImageMagick policy. Security support for the 8.0 series ends on 7 Nov 2026.\n\nThe fixed gems ship an ImageMagick security policy and apply it through MiniMagick. An application whose variant processor is :mini_magick must use mini_magick 5.1 or later; with an older mini_magick the app raises during boot. The shipped policy adds to the host policy rather than replacing it. An application that replaces MiniMagick.cli_env after boot, clears the environment with MiniMagick.cli_prefix, or installs its own MiniMagick::Shell does not receive the shipped policy and must carry the rules in ImageMagick's system policy. GraphicsMagick does not read ImageMagick policies. Confirm the loaded policy through MiniMagick, as the Active Storage guide describes: bin/rails runner 'puts MiniMagick.identify { |i| i.list \"policy\" }'.\n\nSeverity. GHSA-f3w6-w445-fwh9 scores CVSS 3.0 9.8 Critical (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). MITRE CNA CVE-2026-122006 scores CVSS 3.1 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). NVD API (checked 5 Nov 2026): vulnStatus Received, published 2026-11-04T15:17:42.940, lastModified 2026-11-05T17:18:01.240. Secondary CNA metric only; no NVD-produced Primary. FIRST EPSS on 5 Nov 2026: 0.0069 (52.942nd percentile).\n\nRelated, not this bug. The same Rails releases also fix GHSA-v924-7rp8-4mxh (High, reported CVSS 8.8): extension-based decoder selection for video previews, analysis, and image processing. Link it only. Do not conflate this page with July's libvips Active Storage flaw CVE-2026-66066, which is a different processor and a different bug.\n\nExploitation. No known in-the-wild use as of 5 Nov 2026. First disclosed 4 Nov 2026. Badge: No known ITW. The GHSA and the Rails release post do not report attacks. The Hacker News (4 Nov 2026) says the advisory does not say whether the flaw has been exploited. Dark Reading (4 Nov 2026) quotes watchTowr as having reproduced the issue in a lab; that is not a public PoC and is not production exploitation. Pruva REPRO-2026-00389 (published 4 Nov 2026) independently reports lab RCE under deployment-specific conditions. That is not production exploitation.\n\nCredit: RyotaK (GMO Flatt Security) via HackerOne (GHSA credits HackerOne researcher ryotak / Ry0taK; The Hacker News names RyotaK of GMO Flatt Security). Rails security team (GHSA published by flavorjones; release post by Mike Dalessio). Pruva for the independent lab validation.","attackPath":{"caption":"High-level only. Not a reproduction guide. No coder names, payloads, or attach examples. Possible RCE depends on the deployment.","steps":[{"id":"reach","label":"Untrusted attach","detail":"Someone who can attach an upload. Auth depends on the app. This is not a claim that every Rails app is unauthenticated."},{"id":"app","label":"ImageMagick analysis","detail":"Active Storage analyzes the attachment when it is attached. variant_processor is :mini_magick. No variant or preview step is required."},{"id":"unsafe","label":"Host policy allows it","detail":"The host ImageMagick policy does not already deny the dangerous coders. Debian and Ubuntu packaged policies alone do not, per Rails."},{"id":"exec","label":"File write, and Disk read","detail":"Write as the app user. With Disk storage, read files that user can read, including typical app secrets."},{"id":"shell","label":"Possible RCE","detail":"Code execution depends on the deployment: exposed secrets, or writable app paths. Not every install reaches a shell."}]},"exploitation":{"kev":{"listed":false,"date":"2026-11-04","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"Not in CISA KEV (checked 5 Nov 2026) against catalog 2026.11.04 (released 2026-11-04T20:00:05.774Z). CVE-2026-122006 has no catalog row."},"firstSeen":{"date":null,"source":"GHSA-f3w6-w445-fwh9 and the Rails 4 Nov 2026 release post. The Hacker News 4 Nov 2026. Pruva REPRO-2026-00389 (lab only).","note":"No known in-the-wild use as of 5 Nov 2026. First disclosed 4 Nov 2026. The GHSA and Rails release post do not report attacks. The Hacker News says the advisory does not say whether the flaw has been exploited. Pruva reports lab RCE that needed Rails development defaults (code reloading); that is not production exploitation. Badge: No known ITW."},"vendorStatements":[{"vendor":"Rails / Active Storage","date":"2026-11-04","statement":"A Rails application that processes attachments with ImageMagick may allow an unauthenticated attacker to write arbitrary files on the server and, when attachments are stored with the Disk service, to read arbitrary files readable by the application process.","url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","retracted":false},{"vendor":"Rails","date":"2026-11-04","statement":"Possible arbitrary file read, file write and remote code execution in Active Storage image and video processing","url":"https://rubyonrails.org/2026/11/4/Rails-8.0.5.2-and-8.1.4.1-have-been-released","retracted":false}]},"timeline":[{"date":"2026-11-04","event":"Rails published GHSA-f3w6-w445-fwh9. Affected: activestorage before 8.0.5.2, and 8.1.x before 8.1.4.1, when :mini_magick, a permissive host policy, and untrusted attaches all hold. Credit: RyotaK via HackerOne.","source":{"title":"GHSA-f3w6-w445-fwh9","url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","publisher":"Rails"},"kind":"advisory","key":true,"addedDate":"2026-11-04"},{"date":"2026-11-04","event":"Rails 8.0.5.2 and 8.1.4.1 released (Mike Dalessio). The post lists GHSA-f3w6-w445-fwh9 as Critical and names 21 security issues in the same pair of releases, including related GHSA-v924-7rp8-4mxh.","source":{"title":"Rails Versions 8.0.5.2 and 8.1.4.1 have been released","url":"https://rubyonrails.org/2026/11/4/Rails-8.0.5.2-and-8.1.4.1-have-been-released","publisher":"Rails"},"kind":"patch","key":true,"addedDate":"2026-11-04"},{"date":"2026-11-04T14:12:17.584Z","event":"MITRE published CVE-2026-122006. CNA score CVSS 3.1 9.8. CWE-1188. The Hacker News article the same day said a CVE identifier was not yet assigned; the CVE.org record landed that afternoon.","source":{"title":"CVE-2026-122006","url":"https://www.cve.org/CVERecord?id=CVE-2026-122006","publisher":"MITRE"},"kind":"advisory","key":true,"addedDate":"2026-11-04"},{"date":"2026-11-04","event":"Pruva published REPRO-2026-00389. Independent lab validation of file write, Disk-service file read, and RCE under deployment-specific conditions. Not production exploitation.","source":{"title":"REPRO-2026-00389","url":"https://www.pruva.dev/reproductions/REPRO-2026-00389","publisher":"Pruva"},"kind":"poc","key":true,"addedDate":"2026-11-04"},{"date":"2026-11-04","event":"RubySec mirrored GHSA-f3w6-w445-fwh9, including the 8.0 and 8.1 patch commit links.","source":{"title":"GHSA-f3w6-w445-fwh9 (activestorage)","url":"https://rubysec.com/advisories/GHSA-f3w6-w445-fwh9/","publisher":"RubySec"},"kind":"other","addedDate":"2026-11-04"},{"date":"2026-11-04","event":"The Hacker News covers the advisory. It names RyotaK of GMO Flatt Security, says a CVE was not yet assigned at time of writing, and separates this bug from July's libvips CVE-2026-66066.","source":{"title":"Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads","url":"https://thehackernews.com/2026/11/critical-rails-flaw-lets-attackers.html","publisher":"The Hacker News"},"kind":"other","addedDate":"2026-11-04"},{"date":"2026-11-04","event":"Dark Reading covers the advisory. watchTowr is quoted as having reproduced the issue in a lab. That is not a public PoC and is not production exploitation.","source":{"title":"Critical Rails Bug Threatens to Derail Vulnerable Servers","url":"https://www.darkreading.com/application-security/critical-rails-bug-derail-vulnerable-servers","publisher":"Dark Reading"},"kind":"other","addedDate":"2026-11-04"},{"date":"2026-11-04T15:39:34Z","event":"DigitalOcean opened droplet-1-clicks pull request 488 to bump the Ruby on Rails 1-Click image from 8.1.4 to 8.1.4.1. The PR says the live v71 image ships activestorage 8.1.4. Rebuild was still pending when this page was written.","source":{"title":"rails-24-04: bump Rails to 8.1.4.1","url":"https://github.com/digitalocean/droplet-1-clicks/pull/488","publisher":"DigitalOcean"},"kind":"vendor","addedDate":"2026-11-04"},{"date":"2026-11-04","event":"Not in CISA KEV. Catalog 2026.11.04, released 2026-11-04T20:00:05.774Z. Rechecked 5 Nov 2026. CVE-2026-122006 has no catalog row.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"other","key":true,"addedDate":"2026-11-04"},{"date":"2026-11-05T16:41:32.160Z","event":"CVE Program ADP container on CVE-2026-122006 added public references, including DigitalOcean pull request 488 and ruby-advisory-db pull request 1300. This is a reference update, not an exploitation mark.","source":{"title":"CVE-2026-122006 record","url":"https://cveawg.mitre.org/api/cve/CVE-2026-122006","publisher":"CVE Program"},"kind":"other","addedDate":"2026-11-04"}],"openNotes":[{"title":"Possible RCE depends on the deployment","detail":"GHSA says readable secrets may in turn allow remote code execution or lateral movement. Pruva REPRO-2026-00389 reports lab RCE under deployment-specific conditions and is not production exploitation. This page keeps that caveat above the fold.","sources":[{"url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","date":"2026-11-04","publisher":"Rails"},{"url":"https://www.pruva.dev/reproductions/REPRO-2026-00389","date":"2026-11-04","publisher":"Pruva"}]},{"title":"Upload authentication is an app decision","detail":"GHSA impact wording says an unauthenticated attacker. The affected-applications list requires that untrusted users can attach uploads. Auth depends on the app. This page does not claim every Rails app accepts unauthenticated uploads.","sources":[{"url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","date":"2026-11-04","publisher":"Rails"}]},{"title":"Related GHSA-v924-7rp8-4mxh is a different bug","detail":"The same 4 Nov 2026 releases also fix GHSA-v924-7rp8-4mxh (High, reported CVSS 8.8): extension-based decoder selection. Link it only. Do not conflate it with this ImageMagick analysis bug or with July's libvips CVE-2026-66066.","sources":[{"url":"https://github.com/rails/rails/security/advisories/GHSA-v924-7rp8-4mxh","date":"2026-11-04","publisher":"Rails"},{"url":"https://thehackernews.com/2026/11/critical-rails-flaw-lets-attackers.html","date":"2026-11-04","publisher":"The Hacker News"}]},{"title":"The Hacker News said no CVE at time of writing","detail":"The Hacker News (4 Nov 2026) wrote that GHSA-f3w6-w445-fwh9 did not yet have a CVE identifier. MITRE published CVE-2026-122006 at 14:12 UTC the same day. This page uses the CVE.org record.","sources":[{"url":"https://thehackernews.com/2026/11/critical-rails-flaw-lets-attackers.html","date":"2026-11-04","publisher":"The Hacker News"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-122006","date":"2026-11-04","publisher":"MITRE"}]}],"defenderActions":[{"title":"Upgrade activestorage and mini_magick","detail":"Install activestorage 8.0.5.2 or 8.1.4.1. Apps on :mini_magick also need mini_magick 5.1 or later, or they raise at boot. Older unsupported series get no fixed gem; upgrade to 8.0 or later, or use the host-policy workaround.","priority":"now","links":[{"label":"GHSA-f3w6-w445-fwh9","href":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9"},{"label":"Rails 8.0.5.2 and 8.1.4.1 release","href":"https://rubyonrails.org/2026/11/4/Rails-8.0.5.2-and-8.1.4.1-have-been-released"}]},{"title":"Confirm the shipped ImageMagick policy actually loads","detail":"The Active Storage guide: list the policy through MiniMagick with bin/rails runner 'puts MiniMagick.identify { |i| i.list \"policy\" }'. If the app replaces MiniMagick.cli_env, uses MiniMagick.cli_prefix, installs its own MiniMagick::Shell, or uses GraphicsMagick, apply the vendor's policy rules at host level instead.","priority":"now","links":[{"label":"Active Storage ImageMagick security policy","href":"https://guides.rubyonrails.org/active_storage_overview.html#imagemagick-security-policy"},{"label":"GHSA-f3w6-w445-fwh9","href":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9"}]},{"title":"Restrict untrusted attachments; consider vips","detail":"GHSA: an app is in scope only if untrusted users can attach uploads. Limit who can attach. The Rails guide also allows :vips as the variant processor. Switching processor is a config change, not a substitute for the gem upgrade if you still run ImageMagick.","priority":"now","links":[{"label":"GHSA-f3w6-w445-fwh9","href":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9"}]},{"title":"If Disk storage could have exposed secrets, rotate them","detail":"GHSA: change secret_key_base and every secret readable by the application process, including the master key and everything config/credentials.yml.enc holds, storage and database credentials, and third-party tokens. Do not retain an exposed secret as a fallback.","priority":"now","links":[{"label":"GHSA-f3w6-w445-fwh9","href":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9"}]}],"detection":[{"title":"Anomalous Active Storage attachment activity","detail":"Investigative lead, not a vendor signature or IOC. Hunt Active Storage and app access logs for unusual attach volume, unexpected content types, or attaches from accounts that should not upload. A hit is reachability plus an attach, not proof of file write or code execution.","logSource":"Application access logs and Active Storage attach / blob logs","kind":"generic","group":"web-proxy","url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","date":"2026-11-04"},{"title":"ImageMagick policy denials on attach","detail":"Investigative lead, not a vendor signature or IOC. After the shipped policy loads, ImageMagick stderr may record a policy denial when a denied coder is requested. A denial is a blocked attempt lead, not proof of earlier success. The Active Storage guide shows how to list the loaded policy through MiniMagick.","logSource":"ImageMagick stderr / Rails process logs around attach time","kind":"generic","url":"https://guides.rubyonrails.org/active_storage_overview.html#imagemagick-security-policy","date":"2026-11-04"},{"title":"Unexpected file changes near upload time","detail":"Investigative lead, not a vendor signature or IOC. Hunt EDR or FIM for unexpected changes to the app tree, Active Storage disk directories, or temp files around attach times. A file change is a lead, not proof of this CVE.","logSource":"EDR / FIM on the app tree, storage directory, and temp paths","kind":"generic","group":"edr","url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","date":"2026-11-04"},{"title":"Review of app credential use after a Disk-storage window","detail":"Investigative lead, not a vendor signature or IOC. If Disk storage was in use while the app was in scope, review use of signing and encryption secrets and reachable database, storage, and third-party credentials. Unexpected use is a lead for rotation, not proof of this CVE.","logSource":"App credential and token-use logs (signing, database, storage, third-party APIs)","kind":"generic","url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","date":"2026-11-04"},{"title":"No public Nuclei, Sigma, or vendor signature","detail":"None public as of 5 Nov 2026. Do not invent a scanner from the advisory. Use the log-source pointers above. Detection on this page will take a public scanner if one appears.","logSource":"Public rule indexes (Nuclei, Sigma) and vendor signature bulletins","kind":"generic","date":"2026-11-05","dateKind":"checked"}],"detectionRules":[],"detectionLinks":[],"amIAffected":{"summary":"An app is in scope only when activestorage is below 8.0.5.2, or is 8.1.x below 8.1.4.1, and all three GHSA conditions hold: variant_processor is :mini_magick, the host ImageMagick policy does not already deny the involved coders, and untrusted users can attach uploads. Inventory only. Do not attach a test file.","checks":[{"id":"v2s-aia-rails-active-storage-imagemagick-cve-2026-122006-package-1","kind":"package","title":"Record the activestorage and mini_magick gem versions","detail":"Compare activestorage to 8.0.5.2 or 8.1.4.1. Apps on :mini_magick also need mini_magick 5.1 or later after the upgrade. This is inventory only.","command":"bundle show activestorage; bundle show mini_magick; bundle exec rails -v","affectedMeans":"activestorage is below 8.0.5.2, or is 8.1.x below 8.1.4.1.","fixedMeans":"activestorage is 8.0.5.2 or later on the 8.0 line, or 8.1.4.1 or later on the 8.1 line, and (if variant_processor is :mini_magick) mini_magick is 5.1 or later.","notes":"Older unsupported series have no gem on that line. Upgrade to 8.0.5.2 or 8.1.4.1, or apply the host policy workaround.","sources":[{"url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","date":"2026-11-04","publisher":"Rails"}]},{"id":"v2s-aia-rails-active-storage-imagemagick-cve-2026-122006-config-2","kind":"config","title":"Record variant_processor, load_defaults, and who can attach","detail":"GHSA: :mini_magick is the default for load_defaults 6.1 or earlier. Record the setting and whether untrusted users can attach uploads. Do not attach a file as a test.","command":"bundle exec rails runner 'puts Rails.application.config.active_storage.variant_processor'; grep -n load_defaults config/application.rb","affectedMeans":"variant_processor is :mini_magick (or unset on load_defaults 6.1 or earlier) and untrusted users can attach uploads.","fixedMeans":"activestorage is on a fixed gem, or variant_processor is not :mini_magick and ImageMagick is not used for Active Storage, or only trusted users can attach.","notes":"The Rails guide says the default processor depends on the load_defaults target. This page does not invent a 7.0 default. Read the setting you actually run.","sources":[{"url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","date":"2026-11-04","publisher":"Rails"},{"url":"https://guides.rubyonrails.org/active_storage_overview.html#imagemagick-security-policy","date":"2026-11-04","publisher":"Rails"}]},{"id":"v2s-aia-rails-active-storage-imagemagick-cve-2026-122006-config-3","kind":"config","title":"Record the loaded ImageMagick policy and the storage service","detail":"GHSA: Debian and Ubuntu packaged policies do not deny the involved coders. Disk storage is the file-read path. List the policy through MiniMagick. Do not attach a file as a test.","command":"bundle exec rails runner 'puts MiniMagick.identify { |i| i.list \"policy\" }'; bundle exec rails runner 'puts Rails.application.config.active_storage.service'","affectedMeans":"The loaded policy does not deny the involved coders, or MiniMagick is not applying the shipped policy, and untrusted users can attach.","fixedMeans":"The shipped or host policy is loaded and denies the involved coders, or ImageMagick is not used for Active Storage.","notes":"GraphicsMagick does not read ImageMagick policies. Apps that replace MiniMagick.cli_env, use MiniMagick.cli_prefix, or install their own MiniMagick::Shell must carry the rules at host level.","sources":[{"url":"https://guides.rubyonrails.org/active_storage_overview.html#imagemagick-security-policy","date":"2026-11-04","publisher":"Rails"},{"url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","date":"2026-11-04","publisher":"Rails"}]}],"limits":["No sourced Shodan or Censys fingerprint. Do not invent a banner query.","Do not attach a crafted file as a test.","Auth depends on the app. An internet-facing Rails site is not automatically in scope.","SaaS, PaaS, and appliance hosts without a statement stay no statement yet."],"sources":[{"url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","date":"2026-11-04","publisher":"Rails"},{"url":"https://guides.rubyonrails.org/active_storage_overview.html#imagemagick-security-policy","date":"2026-11-04","publisher":"Rails"}],"updatedAt":"2026-11-04","addedDate":"2026-11-04"},"mitigations":{"summary":"GHSA documents a host ImageMagick policy workaround until you can upgrade. Copy the rules of the shipped policy into ImageMagick's system policy. That does not replace 8.0.5.2 or 8.1.4.1. Restricting untrusted attaches and moving to :vips are compensating controls, not gem fixes.","items":[{"title":"Apply the vendor ImageMagick policy rules at host level","detail":"GHSA: copy the rules of the policy the fixed gems ship into ImageMagick's system policy, for example /etc/ImageMagick-7/policy.xml. Older unsupported series have no gem; this is the workaround on those lines. The shipped file path is named on the GHSA. This page does not paste the rules.","limits":"Not a software fix. Still upgrade when a gem exists. GraphicsMagick does not read ImageMagick policies. A host rule that allows a coder, including a wildcard, overrides a shipped deny.","verify":"bin/rails runner 'puts MiniMagick.identify { |i| i.list \"policy\" }' shows the restrictive rules. Re-check after the next ImageMagick or MiniMagick change. Do not attach a file as a test.","source":{"url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","date":"2026-11-04","publisher":"Rails"}},{"title":"Restrict who can attach uploads","detail":"GHSA: an application is in scope only if it allows file uploads from untrusted users. Limit attach actions to trusted accounts until the gem and policy are in place.","limits":"Not a software fix. Trusted users who can attach remain in scope. Still upgrade.","verify":"Untrusted roles can no longer reach an attach action. Confirm in the app's authorization rules, then re-check after the next access review. Do not attach a file as a test.","source":{"url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","date":"2026-11-04","publisher":"Rails"}}],"updatedAt":"2026-11-04","addedDate":"2026-11-04"},"response":{"summary":"Upgrade activestorage and mini_magick, confirm the ImageMagick policy loads, and restrict untrusted attaches. If Disk storage was in use while the app was in scope, rotate signing and encryption secrets and reachable database, storage, and third-party credentials, and do not keep exposed secrets as fallbacks. No sourced persistence paths or IOCs were published.","containment":[{"title":"Upgrade activestorage to 8.0.5.2 or 8.1.4.1 and mini_magick to 5.1 or later","detail":"GHSA: those gems ship the policy. Older mini_magick raises at boot on :mini_magick apps.","sources":[{"url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","date":"2026-11-04","publisher":"Rails"}]},{"title":"Confirm the restrictive policy loads, or apply it at host level","detail":"List the policy through MiniMagick. If MiniMagick.cli_env was replaced, or GraphicsMagick is in use, carry the vendor rules in the system policy.","sources":[{"url":"https://guides.rubyonrails.org/active_storage_overview.html#imagemagick-security-policy","date":"2026-11-04","publisher":"Rails"}]},{"title":"Review attach logs and unexpected file changes","detail":"Hunt Active Storage attach activity, ImageMagick policy denials, and EDR/FIM changes to the app tree, storage, or temp files around upload times. A hit is a lead, not proof.","sources":[{"url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","date":"2026-11-04","publisher":"Rails"}]}],"rotate":[{"item":"secret_key_base, the master key, and config/credentials.yml.enc","reason":"GHSA: if attachments are stored with the Disk service, change secret_key_base and every secret readable by the application process, including the master key and everything config/credentials.yml.enc holds. Do not retain an exposed secret as a fallback.","sources":[{"url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","date":"2026-11-04","publisher":"Rails"}]},{"item":"Storage, database, and third-party credentials reachable by the app process","reason":"GHSA: change storage and database credentials and third-party tokens. Those files typically include credentials for external systems.","sources":[{"url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","date":"2026-11-04","publisher":"Rails"}]}],"evidence":[{"title":"Installed activestorage, mini_magick, and variant_processor from before the upgrade","detail":"Keep bundle show output and the variant_processor setting so you can show whether the three GHSA conditions held.","sources":[{"url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","date":"2026-11-04","publisher":"Rails"}]},{"title":"Active Storage attach logs and ImageMagick stderr","detail":"Keep attach activity and policy-denial lines from the exposure window.","sources":[{"url":"https://guides.rubyonrails.org/active_storage_overview.html#imagemagick-security-policy","date":"2026-11-04","publisher":"Rails"}]},{"title":"EDR / FIM on the app tree, storage, and temp files","detail":"Keep unexpected file-change records around upload times. No sourced persistence path was published.","generic":true,"sources":[{"url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","date":"2026-11-04","publisher":"Rails"}]}],"limits":["No sourced persistence paths or IOCs were published.","No known in-the-wild use as of 5 Nov 2026.","Pruva lab RCE is deployment-specific and is not production exploitation.","No public Nuclei or Sigma rule as of 5 Nov 2026."],"sources":[{"url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","date":"2026-11-04","publisher":"Rails"},{"url":"https://www.pruva.dev/reproductions/REPRO-2026-00389","date":"2026-11-04","publisher":"Pruva"}],"updatedAt":"2026-11-04","addedDate":"2026-11-04"},"bulletins":[],"coverage":[{"title":"GHSA-f3w6-w445-fwh9","publisher":"Rails","url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","date":"2026-11-04","type":"vendor","addedDate":"2026-11-04"},{"title":"Rails Versions 8.0.5.2 and 8.1.4.1 have been released","publisher":"Rails","url":"https://rubyonrails.org/2026/11/4/Rails-8.0.5.2-and-8.1.4.1-have-been-released","date":"2026-11-04","type":"vendor","addedDate":"2026-11-04"},{"title":"ImageMagick Security Policy","publisher":"Rails","url":"https://guides.rubyonrails.org/active_storage_overview.html#imagemagick-security-policy","date":"2026-11-04","type":"vendor","addedDate":"2026-11-04"},{"title":"GHSA-f3w6-w445-fwh9 (activestorage)","publisher":"RubySec","url":"https://rubysec.com/advisories/GHSA-f3w6-w445-fwh9/","date":"2026-11-04","type":"vendor","addedDate":"2026-11-04"},{"title":"CVE-2026-122006","publisher":"MITRE","url":"https://www.cve.org/CVERecord?id=CVE-2026-122006","date":"2026-11-04","type":"vendor","addedDate":"2026-11-04"},{"title":"REPRO-2026-00389","publisher":"Pruva","url":"https://www.pruva.dev/reproductions/REPRO-2026-00389","date":"2026-11-04","type":"research","addedDate":"2026-11-04"},{"title":"Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads","publisher":"The Hacker News","url":"https://thehackernews.com/2026/11/critical-rails-flaw-lets-attackers.html","date":"2026-11-04","type":"news","addedDate":"2026-11-04"},{"title":"Critical Rails Bug Threatens to Derail Vulnerable Servers","publisher":"Dark Reading","url":"https://www.darkreading.com/application-security/critical-rails-bug-derail-vulnerable-servers","date":"2026-11-04","type":"news","addedDate":"2026-11-04"},{"title":"GHSA-v924-7rp8-4mxh (related only)","publisher":"Rails","url":"https://github.com/rails/rails/security/advisories/GHSA-v924-7rp8-4mxh","date":"2026-11-04","type":"vendor","addedDate":"2026-11-04"},{"title":"CISA KEV catalog JSON (CVE-2026-122006 not listed; catalog 2026.11.04)","publisher":"CISA","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-11-04","type":"government","addedDate":"2026-11-04"}],"posts":[],"research":[{"title":"GHSA-f3w6-w445-fwh9","url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","authors":"RyotaK (GMO Flatt Security) via HackerOne; Rails security team","date":"2026-11-04"},{"title":"REPRO-2026-00389","url":"https://www.pruva.dev/reproductions/REPRO-2026-00389","authors":"Pruva","date":"2026-11-04"}],"impact":{"kind":"framework","frameworks":[{"framework":"Active Storage 8.1.x (Ruby on Rails 8.1)","status":"affected","versions":"8.1.0 to before 8.1.4.1 affected; fixed in 8.1.4.1","vendorStatement":{"date":"2026-11-04","url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","quote":"activestorage >= 8.1, < 8.1.4.1"},"addedDate":"2026-11-04"},{"framework":"Active Storage 8.0.x (Ruby on Rails 8.0)","status":"affected","versions":"before 8.0.5.2 affected; fixed in 8.0.5.2","vendorStatement":{"date":"2026-11-04","url":"https://rubyonrails.org/2026/11/4/Rails-8.0.5.2-and-8.1.4.1-have-been-released","quote":"Security support for the 8.0 series ends on November 7, 2026."},"addedDate":"2026-11-04","notes":"Rails 8.0 security support ends 7 Nov 2026 (Rails release post, 4 Nov 2026). Plan a move to 8.1."},{"framework":"Active Storage 7.x and earlier (unsupported Rails)","status":"eol-migrate","versions":"No gem fix. Upgrade to 8.0.5.2 or 8.1.4.1","vendorStatement":{"date":"2026-11-04","url":"https://rubyonrails.org/2026/11/4/Rails-8.0.5.2-and-8.1.4.1-have-been-released","quote":"Older versions of Rails are unsupported, and users are recommended to upgrade to at least the 8.0 series."},"addedDate":"2026-11-04"},{"framework":"Apps that set variant_processor to :vips and do not run ImageMagick for Active Storage","status":"out-of-scope","vendorStatement":{"date":"2026-11-04","url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9","quote":"Uses ImageMagick for Active Storage image processing. This is config.active_storage.variant_processor = :mini_magick, which is the default for applications on load_defaults 6.1 or earlier."},"statusLabel":"Out of scope per GHSA (variant_processor not :mini_magick)","addedDate":"2026-11-04"},{"framework":"DigitalOcean Ruby on Rails 1-Click","status":"no-statement-yet","vendorStatement":{"date":"2026-11-04","url":"https://github.com/digitalocean/droplet-1-clicks/pull/488"},"addedDate":"2026-11-04","notes":"Community PR #488 (open, 4 Nov 2026) proposes 8.1.4.1."},{"framework":"SaaS, PaaS, and appliance hosts that ship Rails","status":"no-statement-yet","addedDate":"2026-11-04"}]},"pocs":[{"title":"Pruva REPRO-2026-00389 lab validation of CVE-2026-122006 (for defenders)","url":"https://www.pruva.dev/reproductions/REPRO-2026-00389","source":"Pruva","validationStatus":"validated","validationDate":"2026-11-04","listedDate":"2026-11-04","notes":"Listed for defenders. The file write and the Disk-service file read were reproduced, and the RCE step needed code reloading (development defaults), per Pruva, dated 4 Nov 2026. Independent lab validation, not production exploitation, and not a vuln2shell validation. Index link only. This site does not copy exploit code, payloads, or usage steps.","addedDate":"2026-11-04","kind":"lab-rce-deployment-specific"}],"_feed":{"page":"https://vuln2shell.com/vulns/rails-active-storage-imagemagick-cve-2026-122006","json":"https://vuln2shell.com/vulns/rails-active-storage-imagemagick-cve-2026-122006.json","iocsCsv":"https://vuln2shell.com/vulns/rails-active-storage-imagemagick-cve-2026-122006/iocs.csv","stix":"https://vuln2shell.com/vulns/rails-active-storage-imagemagick-cve-2026-122006/stix.json","badges":{"patch":"Patched","itw":"No known ITW","poc":"Public PoC (lab RCE, deployment-specific)"}}}