Low Severity
CVE-2026-122006
Published: Nov 11, 2026
# cve-2026-122006-check
Detection script for **CVE-2026-122006** — Rails Active Storage hands uploads to
ImageMagick with unrestricted coders, so a crafted SVG/MSL upload can read/write
arbitrary files on the server (CVSS 9.8). Fixed in activestorage **8.0.5.2** and
**8.1.4.1**. The script **only reports** — it changes nothing.
**Source:** [Rails Active Storage CVE-2026-122006: Patching, Detection and Hunting](https://threatdefence.com/article/rails-active-storage-cve-2026-122006-patching-hunting)
## Quick run (no download)
Run it straight from GitHub in the current directory:
```bash
curl -fsSL https://raw.githubusercontent.com/charlie-goldenowl/cve-2026-122006-check/master/check_cve_2026_122006.sh | bash
```
Scan a specific folder (pass the root after `--`):
```bash
curl -fsSL https://raw.githubusercontent.com/charlie-goldenowl/cve-2026-122006-check/master/check_cve_2026_122006.sh | bash -s -- ~/projects
```
## Run from a local copy
```bash
chmod +x check_cve_2026_122006.sh
./check_cve_2026_122006.sh [ROOT] # ROOT defaults to the current directory
```
- Recurses under `ROOT` and checks **every Rails app** it finds (any dir with
`config/application.rb` + a `Gemfile.lock` pinning activestorage), printing a
per-project verdict and a summary. Point it at a parent folder to scan many
projects at once: `./check_cve_2026_122006.sh ~/projects`.
- Exit code: `0` = none vulnerable, `2` = at least one vulnerable (CI-friendly).
- `NO_COLOR=1 ./check_cve_2026_122006.sh` disables colored output.
- Works on Linux and macOS. Needs `bash` + `ruby`; `magick`/`convert` optional
(used only to check the host ImageMagick policy).
## A project is flagged VULNERABLE when all three hold
1. `activestorage` older than 8.0.5.2 (8.1 line: older than 8.1.4.1).
2. `variant_processor` is `:mini_magick` (Rails 8 default `:vips` is **not**
affected). Read from your config, falling back to the `load_defaults`