Rails Active Storage critical file write and read via crafted ImageMagick uploads (GHSA-f3w6-w445-fwh9)

A critical (CVSS 9.8) flaw in Rails Active Storage lets an unauthenticated attacker write arbitrary files on the server by uploading a crafted file, and, when attachments use the Disk service, read any file the app can read, including secret_key_base and credentials for other systems, which may lead to remote code execution. Active Storage put no limits on which ImageMagick coders an upload could reach, and its ImageMagick analyzer runs on attach, so simply attaching the upload is enough; the reported chain used an SVG reaching the MSL scripting coder. Apps are affected if they use ImageMagick for Active Storage (variant_processor :mini_magick, the default for load_defaults 6.1 or earlier), run a host ImageMagick policy that doesn't block those coders (Debian and Ubuntu's policies don't), and accept untrusted uploads. Fixed in activestorage 8.1.4.1 and 8.0.5.2, which ship a restrictive ImageMagick policy and need mini_magick 5.1 or later; series before 8.0 get no fix. No CVE yet; the advisory does not say whether it has been exploited.

Why this severity: CVSS 9.8, unauthenticated, triggered by attaching an upload; no exploitation reported in the advisory

Started

Nov 4, 2026

• Ruby
• #Rails
• #Active Storage
• #ImageMagick
• #File Upload
• #Arbitrary File Write
• RCE