Critical Rails Active Storage flaw lets crafted ImageMagick uploads write files on servers, fixed in 8.1.4.1 and 8.0.5.2

TLDR

• Rails fixed a critical Active Storage flaw letting unauthenticated attackers write arbitrary files via crafted uploads processed by ImageMagick.²
• Upgrade to Rails 8.1.4.1 or 8.0.5.2; apps using the mini_magick processor also need mini_magick 5.1 or later.²
• Apps storing files on the Disk service should rotate secret_key_base and every secret the app process can read.²

The Rails maintainers have published a critical advisory, GHSA-f3w6-w445-fwh9, for Active Storage, the Rails component that handles file uploads.² It says a Rails application that processes attachments with ImageMagick may allow an unauthenticated attacker to write arbitrary files on the server.² When attachments are stored with the Disk service, the attacker may also read any file the application process can read, which typically includes secret_key_base and credentials for external systems and may allow escalation to remote code execution or lateral movement.² The advisory rates the flaw 9.8 on the CVSS scale.²

Rails says ImageMagick selects a coder from the content of the file it is given, that some coders act on files named inside the image, and that Active Storage constrained none of them.² The ImageMagick analyzer runs when a file is attached, so attaching the upload is enough, with no variant, preview or analyze call required.² Rails says one attack chain has been reported to it but it does not assume that is the only one.² The Hacker News reports that an uploaded SVG file reached ImageMagick's MSL scripting coder through that analyzer, citing the commit that fixed the flaw, and that the advisory does not say whether the flaw has been exploited.¹

An application is affected only if it uses ImageMagick for Active Storage image processing, runs ImageMagick under a security policy that does not already deny the coders involved, and accepts uploads from untrusted users.² The advisory says the policies packaged by Debian and Ubuntu do not deny them.² The affected versions are those before 8.0.5.2 and 8.1 releases before 8.1.4.1.² The fixed releases ship an ImageMagick security policy, which applies to every ImageMagick command that MiniMagick runs, and Rails says the shipped policy adds to the host's policy rather than replacing it.² Rails credits HackerOne researcher ryotak with the report, and The Hacker News names the researcher as RyotaK of GMO Flatt Security.¹²

The sources differ on whether a CVE exists. The Hacker News says the flaw has no CVE identifier yet.¹ OpenCVE lists CVE-2026-122006, assigned by MITRE and published on 4 November 2026, with the same 9.8 score.⁵ Rails says the same releases fix 21 security issues, ranking this one critical, and that security support for the 8.0 series ends on 7 November 2026.³ Jake Knott, head of threat intelligence at watchTowr, told Dark Reading the firm has reproduced the vulnerability in a lab, that exploitation against the right target would not be difficult, and that he would be surprised if public proof-of-concept code took more than a few days to appear.⁴

Why it matters: a file upload alone can reach the flaw in affected Rails apps, and Rails says leaked secrets mean fixing the code is not enough, as Disk-service apps must also replace every secret the application process could read.²