CVE-2026-126082

{
  "etk_id": "ETK-2026-4101",
  "cve_id": "CVE-2026-126082",
  "display_id": "CVE-2026-126082",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-122934",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Arbitrary file read and write in Rails Active Storage",
  "summary": "Rails Active Storage applications using MiniMagick with untrusted file uploads may permit unauthenticated attackers to write files on the server. Deployments using the Disk storage service may also expose files readable by the application process. Exposure depends on the active ImageMagick security policy permitting the relevant coders.",
  "mitigation": "Upgrade Rails to 8.1.4.1 or 8.0.5.2. Until upgraded, restrict untrusted uploads and enforce an ImageMagick security policy that denies unnecessary coders.",
  "vendor": "rails",
  "product": "rails",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 8.1, < 8.1.4.1"
      ],
      "ecosystem": "rubygems",
      "fixed_versions": [
        "8.1.4.1"
      ],
      "package_name": "activestorage",
      "purl": "pkg:gem/activestorage"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 8.0.5.2"
      ],
      "ecosystem": "rubygems",
      "fixed_versions": [
        "8.0.5.2"
      ],
      "package_name": "activestorage",
      "purl": "pkg:gem/activestorage"
    }
  ],
  "cwes": [
    1188
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 21.9745119,
  "t0_at": "2026-11-10T21:08:05.402000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-10T21:08:05.402000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-10T21:08:05.402000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-126082"
    }
  }
}