The Rails team has released fixes for a critical flaw in Active Storage that can let an unauthenticated attacker write arbitrary files on a server by uploading a crafted file. The advisory rates it 9.8 out of 10, and applications that use ImageMagick with Active Storage and accept uploads from untrusted users are the ones at risk.
What happened
On November 4, 2026, the Rails maintainers published advisory GHSA-f3w6-w445-fwh9, titled “Possible arbitrary file write and read in Active Storage image analysis.” It has no CVE identifier yet. ImageMagick chooses a file decoder (a “coder”) based on what is inside the file, and some coders act on files named within the image. According to the advisory, Active Storage did not restrict any of those coders.
The ImageMagick analyzer runs when a file is attached, so attaching a crafted upload is enough; no image variant, preview or explicit analyze call is needed. The Hacker News, citing the fix commit, reports that an uploaded SVG reached ImageMagick’s MSL coder through that analyzer. With the Disk storage service, the advisory says an attacker can also read any file the application process can read, which typically includes secret_key_base and credentials for other systems. That could lead to remote code execution or lateral movement.
The issue was reported through HackerOne by the researcher RyotaK. Rails says one attack chain was reported but does not assume it is the only one. The flaw is fixed in Active Storage 8.1.4.1 and 8.0.5.2.
Who is affected
An application is affected only if all three of these are true, according to the advisory:
- It uses ImageMagick for Active Storage image processing (
config.active_storage.variant_processor = :mini_magick), which is the default forload_defaults 6.1or earlier. Newer Rails defaults use libvips. - Its ImageMagick security policy does not already block the coders involved. Rails says the default policies on Debian and Ubuntu do not.
- It accepts file uploads from untrusted users.
Affected versions are Active Storage releases before 8.0.5.2, and the 8.1 series before 8.1.4.1. Release lines older than 8.0 are unsupported and will not get fixed versions, per The Hacker News, so those apps need the workaround below or an upgrade. The same report says Rails 8.0 receives security fixes only until November 7, 2026.
What to do
- Upgrade to Rails 8.1.4.1 or 8.0.5.2. Apps using
:mini_magickalso need mini_magick 5.1 or later, or they raise an error at boot. - If you cannot upgrade yet, copy the rules from the policy file shipped in the fixed releases into ImageMagick’s system policy (for example
/etc/ImageMagick-7/policy.xml). At a minimum, the advisory says to block the MSL coder, the Ghostscript-backed coders and thegsdelegate. - Check the policy loads after upgrading: the Hacker News article gives
bin/rails runner 'puts MiniMagick.identify { |i| i.list "policy" }'. Apps that replaceMiniMagick.cli_env, clear the environment withMiniMagick.cli_prefix, or use GraphicsMagick do not get the shipped policy. - If you render PDF or PostScript through ImageMagick, re-allow the
gsdelegate and the coders you need after tightening the policy. - If you use the Disk service, the advisory says to rotate
secret_key_baseand every secret the app process can read, including the master key, credentials, database and storage credentials, and third-party tokens.
Our analysis: teams that cannot tell whether they use ImageMagick should check the variant_processor setting first, since that decides exposure, and should review upload logs and application servers for unexpected new files from before the patch.
What we still do not know
The advisory does not say whether the flaw has been exploited in the wild, and no CVE has been assigned yet. Rails has not said how many applications are exposed, and neither source explains how an operator can confirm whether a server has already been targeted. The same releases also fix other issues, including a related high-severity Active Storage advisory (GHSA-v924-7rp8-4mxh, CVSS 8.8), so upgrading covers more than this one bug.
Sources: Rails security advisory GHSA-f3w6-w445-fwh9 (Nov 4, 2026); The Hacker News, “Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads” (Nov 4, 2026).
Leave a Reply