Critical Ruby on Rails Active Storage flaw lets attackers access server files via crafted image uploads
- Severity
- Critical
- Sources
- 1
What happened
Ruby on Rails Active Storage flaw (no CVE assigned yet, CVSS 9.8, advisory published 4 November 2026) lets unauthenticated users write files and, with the Disk service, read files via ImageMagick coder abuse triggered on attach. Affected: activestorage before 8.0.5.2 and 8.1 before 8.1.4.1, where the app uses :minimagick, runs ImageMagick without blocking the relevant coders, and accepts untrusted uploads. Upgrade to 8.0.5.2 or 8.1.4.1 with minimagick 5.1 or newer; if patching is delayed, enforce the policy rules blocking MSL, Ghostscript coders and gs delegate. Rotate secretkeybase and all readable secrets if Disk service was in use.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Upgrade activestorage to 8.0.5.2 or 8.1.4.1 and, if using :minimagick, upgrade minimagick to 5.1 or newer.
- If the app uses the Disk service, change secretkeybase and every other secret the app process can read.
- If patching cannot happen immediately, copy the shipped ImageMagick policy rules into the system policy.xml, at minimum blocking the MSL coder, the Ghostscript coders and the gs delegate.
- Review logs for unusual uploads and check that no app runs with extra file permissions.
Written by AI from the sources, checked against them