CVE-2026-122006

Name of the Vulnerable Software and Affected Versions activestorage versions prior to 8.0.5.2 activestorage versions prior to 8.1.4.1

Description An issue exists during ImageMagick attachment processing where the analyzer runs when a file is attached. Due to the absence of a restrictive ImageMagick security policy to block unintended functionality, unauthenticated remote attackers can trigger arbitrary server read and write operations, which may allow the exfiltration of the secret key base variable.

Recommendations Update to version 8.0.5.2. Update to version 8.1.4.1. Enforce a strict ImageMagick security policy to block unintended file operations.