ACTIVESTORAGE · GHSA-wgv4-95jc-33jm · Package
NO FIX YET
This advisory is withdrawn as a duplicate of GHSA-f3w6-w445-fwh9, so the live record is that one. The original text says Active Storage's ImageMagick analyzer, run when a file is attached, can let an attacker read and write files on the server, such as reading secret_key_base.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Rails applications that use Active Storage to attach and analyze images with ImageMagick are the ones described. The original text names the analyzer running at attach time as the path, so apps that never attach images or do not use ImageMagick are less exposed. Teams should use the live advisory GHSA-f3w6-w445-fwh9 for the authoritative range.
Not affected if no-image-attachments, non-imagemagick-processor
Who cares activestorage, imagemagick, rails, ruby
bundle exec rails -v or check the activestorage version in Gemfile.lockconfig.active_storage.variant_processor set to :mini_magick)Unknown from the sources.
This advisory has been withdrawn because it is a duplicate of GHSA-f3w6-w445-fwh9. This link is maintained to preserve external references.
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.