# Rails Active Storage critical file write and read via crafted ImageMagick uploads (GHSA-f3w6-w445-fwh9) · pwn.watch > A critical (CVSS 9.8) flaw in Rails Active Storage lets an unauthenticated attacker write arbitrary files on the server by uploading a crafted file, and, when attachments use the Disk service, read any file the app can read, including secret_key_base and credentials for other systems, which may lead to remote code execution. Active Storage put no limits on which ImageMagick coders an upload could reach, and its ImageMagick analyzer runs on attach, so simply attaching the upload is enough; the reported chain used an SVG reaching the MSL scripting coder. Apps are affected if they use ImageMagick for Active Storage (variant_processor :mini_magick, the default for load_defaults 6.1 or earlier), run a host ImageMagick policy that doesn't block those coders (Debian and Ubuntu's policies don't), and accept untrusted uploads. Fixed in activestorage 8.1.4.1 and 8.0.5.2, which ship a restrictive ImageMagick policy and need mini_magick 5.1 or later; series before 8.0 get no fix. No CVE yet; the advisory does not say whether it has been exploited. Page: https://pwn.watch/i/rails-active-storage-imagemagick-file-write-ghsa-f3w6-w445-fwh9 · generated 2026-11-04T15:19:03.586Z ## Status - Severity: critical · status: live · patch: patched - Product: Ruby on Rails Active Storage (activestorage gem) - Started: 2026-11-04 - Affected: activestorage < 8.0.5.2; activestorage >= 8.1, < 8.1.4.1; Only apps using ImageMagick (:mini_magick) for Active Storage that accept untrusted uploads - Fixed in: activestorage 8.1.4.1; activestorage 8.0.5.2 (requires mini_magick >= 5.1 when using :mini_magick); Rails before 8.0: no fix; copy the shipped policy.xml rules (deny MSL, Ghostscript coders and the gs delegate) into the system ImageMagick policy ## Follow this incident - RSS (one item per update): https://pwn.watch/i/rails-active-storage-imagemagick-file-write-ghsa-f3w6-w445-fwh9/feed.xml - JSON Feed: https://pwn.watch/i/rails-active-storage-imagemagick-file-write-ghsa-f3w6-w445-fwh9/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/rails-active-storage-imagemagick-file-write-ghsa-f3w6-w445-fwh9.json - This file: https://pwn.watch/i/rails-active-storage-imagemagick-file-write-ghsa-f3w6-w445-fwh9/llms.txt ## Updates (newest first) - 2026-11-04: Rails publishes GHSA-f3w6-w445-fwh9 (critical, CVSS 9.8) and releases Rails 8.1.4.1 and 8.0.5.2, which ship an ImageMagick security policy; reported via HackerOne by RyotaK (GMO Flatt Security). (https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9) - 2026-11-04: The Hacker News reports the flaw; the same releases fix a second Active Storage issue, GHSA-v924-7rp8-4mxh (high, CVSS 8.8), and 21 security issues in total. (https://thehackernews.com/2026/11/critical-rails-flaw-lets-attackers.html) ## Fix brief # Security brief: Rails Active Storage critical file write and read via crafted ImageMagick uploads (GHSA-f3w6-w445-fwh9) Source: https://pwn.watch/i/rails-active-storage-imagemagick-file-write-ghsa-f3w6-w445-fwh9 · status: live · severity: critical · updated Nov 4, 2026, 12:30 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is A critical (CVSS 9.8) flaw in Rails Active Storage lets an unauthenticated attacker write arbitrary files on the server by uploading a crafted file, and, when attachments use the Disk service, read any file the app can read, including secret_key_base and credentials for other systems, which may lead to remote code execution. Active Storage put no limits on which ImageMagick coders an upload could reach, and its ImageMagick analyzer runs on attach, so simply attaching the upload is enough; the reported chain used an SVG reaching the MSL scripting coder. Apps are affected if they use ImageMagick for Active Storage (variant_processor :mini_magick, the default for load_defaults 6.1 or earlier), run a host ImageMagick policy that doesn't block those coders (Debian and Ubuntu's policies don't), and accept untrusted uploads. Fixed in activestorage 8.1.4.1 and 8.0.5.2, which ship a restrictive ImageMagick policy and need mini_magick 5.1 or later; series before 8.0 get no fix. No CVE yet; the advisory does not say whether it has been exploited. Severity detail: CVSS 9.8, unauthenticated, triggered by attaching an upload; no exploitation reported in the advisory - Product: Ruby on Rails Active Storage (activestorage gem) ## Affected versions - activestorage < 8.0.5.2 - activestorage >= 8.1, < 8.1.4.1 - Only apps using ImageMagick (:mini_magick) for Active Storage that accept untrusted uploads ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - activestorage 8.1.4.1 - activestorage 8.0.5.2 (requires mini_magick >= 5.1 when using :mini_magick) - Rails before 8.0: no fix; copy the shipped policy.xml rules (deny MSL, Ghostscript coders and the gs delegate) into the system ImageMagick policy After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes If you run Rails with Active Storage: check config.active_storage.variant_processor (unset means :mini_magick before load_defaults 7.0). Upgrade to 8.1.4.1 or 8.0.5.2 with mini_magick >= 5.1, then verify the policy loads with bin/rails runner 'puts MiniMagick.identify { |i| i.list "policy" }'. If attachments use the Disk service, rotate secret_key_base, the master key and every credential the app can read. ## Latest updates - Nov 4, 2026: Rails publishes GHSA-f3w6-w445-fwh9 (critical, CVSS 9.8) and releases Rails 8.1.4.1 and 8.0.5.2, which ship an ImageMagick security policy; reported via HackerOne by RyotaK (GMO Flatt Security). - Nov 4, 2026: The Hacker News reports the flaw; the same releases fix a second Active Storage issue, GHSA-v924-7rp8-4mxh (high, CVSS 8.8), and 21 security issues in total. ## Advisories - [Possible arbitrary file write and read in Active Storage image analysis (GHSA-f3w6-w445-fwh9)](https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9) (Rails) ## Write-ups & news - [Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads](https://thehackernews.com/2026/11/critical-rails-flaw-lets-attackers.html) --- Machine-readable: https://pwn.watch/i/rails-active-storage-imagemagick-file-write-ghsa-f3w6-w445-fwh9.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.