CVE-2026-122006: Server file read in Rails activestorage

CVE-2026-122006 is a critical vulnerability in the activestorage gem of Ruby on Rails (versions before 8.1.4.1) that exposes the server to unauthorized read and write operations on files when an attachment is processed. The issue stems from the ImageMagick analyzer running without a security policy that blocks unintended functionality, allowing attackers to access sensitive data such as session keys (secret_key_base) directly from the server's file system.

The severity is critical with CVSS 9.8. According to information published on NVD on November 4, 2026, the vulnerability allows both read and write operations on server files during attachment processing. Repository activity signals were detected on November 5, 2026, less than 24 hours after publication, indicating the community has already identified the vulnerability.

IT teams and sysadmins must immediately update activestorage to version 8.1.4.1 or later. In parallel, review file processing logs to detect any anomalous access that occurred before the update. Implementing an explicit security policy for ImageMagick is an essential additional defense measure.

The vulnerability represents an immediately exploitable risk on any Rails instance with activestorage exposed to file uploads from untrusted users. Since the attack mechanism is passive (simply attaching a file triggers the vulnerability), administrators must treat this update as high priority in their November 2026 patch management.