CVE-2026-122006: activestorage: activestorage: arbitrary file read and write via ImageMagick attachment analysis

Severity: Critical

CVSS Score: 9.8

The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.