{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Rails Active Storage critical file write and read via crafted ImageMagick uploads (GHSA-f3w6-w445-fwh9) · updates",
  "home_page_url": "https://pwn.watch/i/rails-active-storage-imagemagick-file-write-ghsa-f3w6-w445-fwh9",
  "feed_url": "https://pwn.watch/i/rails-active-storage-imagemagick-file-write-ghsa-f3w6-w445-fwh9/feed.json",
  "description": "A critical (CVSS 9.8) flaw in Rails Active Storage lets an unauthenticated attacker write arbitrary files on the server by uploading a crafted file, and, when attachments use the Disk service, read any file the app can read, including secret_key_base and credentials for other systems, which may lead to remote code execution. Active Storage put no limits on which ImageMagick coders an upload could reach, and its ImageMagick analyzer runs on attach, so simply attaching the upload is enough; the reported chain used an SVG reaching the MSL scripting coder. Apps are affected if they use ImageMagick for Active Storage (variant_processor :mini_magick, the default for load_defaults 6.1 or earlier), run a host ImageMagick policy that doesn't block those coders (Debian and Ubuntu's policies don't), and accept untrusted uploads. Fixed in activestorage 8.1.4.1 and 8.0.5.2, which ship a restrictive ImageMagick policy and need mini_magick 5.1 or later; series before 8.0 get no fix. No CVE yet; the advisory does not say whether it has been exploited.",
  "language": "en",
  "_pwn": {
    "slug": "rails-active-storage-imagemagick-file-write-ghsa-f3w6-w445-fwh9",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/rails-active-storage-imagemagick-file-write-ghsa-f3w6-w445-fwh9/feed.xml",
    "llms": "https://pwn.watch/i/rails-active-storage-imagemagick-file-write-ghsa-f3w6-w445-fwh9/llms.txt",
    "json": "https://pwn.watch/i/rails-active-storage-imagemagick-file-write-ghsa-f3w6-w445-fwh9.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/rails-active-storage-imagemagick-file-write-ghsa-f3w6-w445-fwh9#2026-11-04-c5e8fbfa",
      "url": "https://pwn.watch/i/rails-active-storage-imagemagick-file-write-ghsa-f3w6-w445-fwh9#2026-11-04-c5e8fbfa",
      "title": "Rails Active Storage critical file write and read via crafted ImageMagick uploads (GHSA-f3w6-w445-fwh9): Rails publishes GHSA-f3w6-w445-fwh9 (critical, CVSS 9.8) and releases Rails 8.1.4.1 and 8.0.5.2, which ship an ImageMagick security policy; reported via HackerOne by RyotaK (GMO Flatt Security).",
      "content_text": "Rails Active Storage critical file write and read via crafted ImageMagick uploads (GHSA-f3w6-w445-fwh9): Rails publishes GHSA-f3w6-w445-fwh9 (critical, CVSS 9.8) and releases Rails 8.1.4.1 and 8.0.5.2, which ship an ImageMagick security policy; reported via HackerOne by RyotaK (GMO Flatt Security).\n\nSource: https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9",
      "date_published": "2026-11-04T00:00:00.000Z",
      "external_url": "https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/rails-active-storage-imagemagick-file-write-ghsa-f3w6-w445-fwh9#2026-11-04-c4fcbf8f",
      "url": "https://pwn.watch/i/rails-active-storage-imagemagick-file-write-ghsa-f3w6-w445-fwh9#2026-11-04-c4fcbf8f",
      "title": "Rails Active Storage critical file write and read via crafted ImageMagick uploads (GHSA-f3w6-w445-fwh9): The Hacker News reports the flaw; the same releases fix a second Active Storage issue, GHSA-v924-7rp8-4mxh (high, CVSS 8.8), and 21 security issues in total.",
      "content_text": "Rails Active Storage critical file write and read via crafted ImageMagick uploads (GHSA-f3w6-w445-fwh9): The Hacker News reports the flaw; the same releases fix a second Active Storage issue, GHSA-v924-7rp8-4mxh (high, CVSS 8.8), and 21 security issues in total.\n\nSource: https://thehackernews.com/2026/11/critical-rails-flaw-lets-attackers.html",
      "date_published": "2026-11-04T00:00:00.000Z",
      "external_url": "https://thehackernews.com/2026/11/critical-rails-flaw-lets-attackers.html",
      "tags": [
        "critical"
      ]
    }
  ]
}