ETK-2026-3505Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-3505",
  "cve_id": null,
  "display_id": "ETK-2026-3505",
  "ghsa_id": null,
  "euvd_id": null,
  "status": "retired",
  "anchor_state": "awaiting_cve",
  "title": "Arbitrary file access through Active Storage ImageMagick processing",
  "summary": "Active Storage applications using MiniMagick/ImageMagick for image processing may allow untrusted uploaders to cause arbitrary file writes. Applications using the Disk service may also expose files readable by the application process. Exposure requires untrusted uploads and an ImageMagick security policy that does not already block the relevant coders.",
  "mitigation": "Upgrade activestorage to 8.1.4.1 or 8.0.5.2 and ensure MiniMagick is at least 5.1 when using the MiniMagick variant processor. If an immediate upgrade is not possible, apply the fixed release's ImageMagick policy rules in the system policy.",
  "vendor": "rubygems",
  "product": "rubygems:activestorage",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 8.1, < 8.1.4.1"
      ],
      "ecosystem": "rubygems",
      "fixed_versions": [
        "8.1.4.1"
      ],
      "package_name": "activestorage",
      "purl": "pkg:gem/activestorage"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 8.0.5.2"
      ],
      "ecosystem": "rubygems",
      "fixed_versions": [
        "8.0.5.2"
      ],
      "package_name": "activestorage",
      "purl": "pkg:gem/activestorage"
    }
  ],
  "cwes": [
    1188
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": null,
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": null,
  "t0_at": null,
  "signals": {}
}