Vulnerabilities · 1 day ago
Ruby on Rails fixed an unauthenticated Active Storage upload flaw in releases 8.1.4.1 and 8.0.5.2. It affects apps that accept untrusted uploads, use ImageMagick through MiniMagick, and allow the relevant ImageMagick handlers; in Disk-service apps, the flaw can also expose files Rails can read.
When Rails analyzes an attached image, ImageMagick chooses a handler based on the file’s contents; some handlers can follow instructions in the file to read or write other server files. Attaching the file triggers analysis—no preview or conversion is needed. That can expose Rails secrets and credentials for other systems, potentially extending impact beyond the host. Rails says one attack chain was reported but does not assume it is the only one.
For Disk-service apps, the trust boundary reaches systems whose credentials Rails can read: a fixed Rails host may still leave those credentials usable if they were exposed. The advisory does not say whether attackers have exploited the flaw.
2 sources covering this story
Critical Rails Bug Threatens to Derail Vulnerable Servers
Rails maintainers patched a critical Active Storage flaw that could let attackers read sensitive files and write arbitrary files via image uploads.
Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads
Rails fixes a critical Active Storage flaw that enables arbitrary file writes through ImageMagick uploads and file reads in Disk service apps.
Part of the PlainSec briefing for 2026-11-05