Rails Active Storage flaw allows possible arbitrary file write and read
VULNERABILITYActive Storageredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Advisory AV26-1129 from the Canadian Centre for Cyber Security, dated 5 November 2026, covers a possible arbitrary file write and read in Active Storage image analysis in Rails. Affected versions are Active Storage prior to 8.0.5.2 and prior to 8.1.4.1. The source gives no CVE identifier. Defenders should upgrade to 8.0.5.2 on the 8.0 branch or 8.1.4.1 on the 8.1 branch, and review the linked Rails release notes.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Upgrade Rails Active Storage to 8.0.5.2 or later if you run the 8.0 branch.
- Upgrade Rails Active Storage to 8.1.4.1 or later if you run the 8.1 branch.
- Review the linked Rails 8.0.5.2 and 8.1.4.1 release notes.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Canadian Centre for Cyber Security
Who and what is in it
Companies
Products