CVE-2026-122006
Description
A flaw was found in Active Storage. When processing file attachments using ImageMagick, the analyzer executes without an adequate security policy to restrict unintended operations. A remote attacker can exploit this vulnerability by uploading a crafted file, allowing unauthorized read and write operations on the server file system. This can lead to the exposure of sensitive application secrets, data tampering, or system compromise.
Statement
A flaw in Active Storage's ImageMagick attachment analyzer allows a remote, unauthenticated attacker to upload a crafted file and execute unauthorized filesystem read and write operations due to the absence of a restrictive security policy during processing.
Mitigation
Configure an explicit, restrictive ImageMagick security policy (`policy.xml`) on the host to disable hazardous coders, or transition Active Storage attachment analysis and variant processing to use `vips` instead of `imagemagick`.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce a restrictive ImageMagick security policy denying hazardous coders during Active Storage attachment analysis or migrate processing to vips: upgrade to activestorage 8.0.5.2, 8.1.4.1+ (or the corresponding fixed Red Hat builds), which bundle a restrictive ImageMagick policy.xml denying dangerous coders and prepend its path to MAGICK_CONFIGURE_PATH via MiniMagick.cli_env, closing all 2 injection vectors (crafted file upload triggering the ImageMagick MSL coder, crafted file upload invoking Ghostscript delegate coders). Until patched, this is a concern on Rails applications using Active Storage configured with ImageMagick or MiniMagick that accept and analyze file uploads, so configure a restrictive ImageMagick host policy.xml disabling MSL and Ghostscript coders, or configure Active Storage attachment analysis and variant processing to use vips instead of imagemagick. As a compensating measure, monitor with EDR agents to detect behavioral anomalies such as ImageMagick attempting unauthorized filesystem reads or writes outside upload directories, configure auditd to log file access syscalls when ImageMagick coders access sensitive application files or write to unauthorized paths, and use Falco or eBPF runtime security to detect anomalous sensitive file read and write operations or unexpected delegate child processes spawned by ImageMagick. These controls limit blast radius and contain exploitation, but they do not fix the underlying unrestricted ImageMagick coder execution defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1001 EDR Agent (Endpoint Detection & Response) (medium)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 9.8 | N/A | 9.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
The impact of insecure defaults varies widely depending on the functionality that the product controls.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
