Critical Rails Active Storage flaw patched; Socket offers free interim fix
CRITICAL · VULNERABILITYImageMagickredteam/daily · 1 source
- Severity
- Critical
- Sources
- 1
What happened
Rails 8.0.5.2 and 8.1.4.1 (released 4 November 2026) fix 21 vulnerabilities, including GHSA-f3w6-w445-fwh9 (CVSS 9.8), an Active Storage flaw where ImageMagick coders are unrestricted, enabling unauthenticated arbitrary file writes and, on Disk service, reads of secretkeybase and credentials. Vulnerable if variantprocessor is :minimagick, the ImageMagick policy does not block dangerous coders, and untrusted uploads are accepted. Upgrade Rails, require MiniMagick 5.1 or later, rotate exposed secrets, or apply Socket's free Certified Patch as an interim measure. Rails 8.0 security support ends 7 November 2026.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Upgrade Ruby on Rails to 8.1.4.1, or to 8.0.5.2 if remaining on the 8.0 series.
- Update MiniMagick to version 5.1 or later if the application uses :minimagick.
- Apply Socket's free Certified Patch for GHSA-f3w6-w445-fwh9 if an immediate Rails upgrade is not practical.
- Rotate potentially exposed credentials for applications using Active Storage's Disk service.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Socket Blog
Who and what is in it
Companies