{"id":"GHSA-wgv4-95jc-33jm","kind":"vulnerability","aliases":["GHSA-wgv4-95jc-33jm"],"related":[],"title":"Duplicate Advisory: Active Storage: Possible arbitrary file write and read in Active Storage image analysis","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-f3w6-w445-fwh9. This link is maintained to preserve external references.\n\n## Original Description\nThe activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.","summary":"This advisory is withdrawn as a duplicate of GHSA-f3w6-w445-fwh9, so the live record is that one. The original text says Active Storage's ImageMagick analyzer, run when a file is attached, can let an attacker read and write files on the server, such as reading secret_key_base.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"activestorage","fixed":[],"affected":"< 8.0.5.2","ecosystem":"rubygems"}],"ecosystems":["rubygems"],"tags":["activestorage","cwe-1188","imagemagick","package","rails","ruby"],"not_affected_if":["no-image-attachments","non-imagemagick-processor"],"how_to_check":"- Run `bundle exec rails -v` or check the `activestorage` version in `Gemfile.lock`\n- Check whether the app uses Active Storage image analysis with ImageMagick (`config.active_storage.variant_processor` set to `:mini_magick`)\n- Follow the live advisory GHSA-f3w6-w445-fwh9 for the affected range","fix":null,"status":"withdrawn","published_at":"2026-11-04T15:32:31+00:00","first_seen_at":"2026-11-12T23:49:07+00:00","triaged_at":"2026-11-12T23:51:10+00:00","updated_at":"2026-11-12T23:51:10+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-12T23:51:10Z","model":"claude-haiku-5-5","output":{"fix":"- activestorage gem: `8.0.5.2` is listed as the fixed version in the product data for the duplicate; the original text says `8.1.4.1`, so confirm against GHSA-f3w6-w445-fwh9","reach":"internet","title":"Rails Active Storage: ImageMagick analysis allows arbitrary file write and read","impact":"high","summary":"This advisory is withdrawn as a duplicate of GHSA-f3w6-w445-fwh9, so the live record is that one. The original text says Active Storage's ImageMagick analyzer, run when a file is attached, can let an attacker read and write files on the server, such as reading secret_key_base.","audience":"businesses","category":"package","nicknames":[],"who_cares":["rails","activestorage","imagemagick","ruby"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"Server reads and writes files, including secret_key_base","analyst_note":"Advisory is withdrawn as duplicate; confirm the fixed version and status against GHSA-f3w6-w445-fwh9 before acting on this entry.","how_to_check":"- Run `bundle exec rails -v` or check the `activestorage` version in `Gemfile.lock`\n- Check whether the app uses Active Storage image analysis with ImageMagick (`config.active_storage.variant_processor` set to `:mini_magick`)\n- Follow the live advisory GHSA-f3w6-w445-fwh9 for the affected range","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-image-attachments","non-imagemagick-processor"],"who_is_affected":"Rails applications that use Active Storage to attach and analyze images with ImageMagick are the ones described. The original text names the analyzer running at attach time as the path, so apps that never attach images or do not use ImageMagick are less exposed. Teams should use the live advisory GHSA-f3w6-w445-fwh9 for the authoritative range.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000829,"input_tokens":4683,"output_tokens":722,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-1188':29B '33jm':20A,25A '8.1.4.1':118C '95jc':19A,24A 'activ':3A,12A,58B 'activestorag':27B,115C 'activestorage':26A 'advisori':2A,35B,87C,89C 'allow':129C 'analysi':15A 'analyz':62B,143C 'arbitrari':6A 'attach':68B,125C,149C 'attack':72B 'base':85B,139C 'block':159C 'cwe':28B 'descript':113C 'duplic':1A,40B,86C,97C 'e.g':135C 'extern':110C 'f3w6':44B,101C 'file':7A,66B,76B,147C 'function':161C 'fwh9':46B,103C 'gem':116C 'ghsa':17A,22A,43B,100C 'ghsa-f3w6-w445-fwh9':42B,99C 'ghsa-wgv4-95jc-33jm':16A,21A 'imag':14A 'imagemagick':30B,61B,124C,142C,155C 'key':84B,138C 'let':70B 'link':105C 'live':49B 'maintain':107C 'occur':127C 'one':53B 'oper':134C 'origin':55B,112C 'packag':31B 'polici':157C 'possibl':5A 'preserv':109C 'process':126C 'rail':32B,122C 'read':10A,73B,82B,131C,136C 'record':50B 'refer':111C 'rubi':33B,120C 'run':63B,144C 'say':57B 'secret':83B,137C 'secur':156C 'server':79B,130C 'storag':4A,13A,59B 'text':56B 'unintend':160C 'w445':45B,102C 'wgv4':18A,23A 'withdrawn':37B,92C 'write':8A,75B,133C","nicknames":[],"mitigations":[],"who_affected":"Rails applications that use Active Storage to attach and analyze images with ImageMagick are the ones described. The original text names the analyzer running at attach time as the path, so apps that never attach images or do not use ImageMagick are less exposed. Teams should use the live advisory GHSA-f3w6-w445-fwh9 for the authoritative range.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["activestorage"],"ptokens":["activestorage"],"labels":["activestorage","critical","cwe1188","imagemagick","package","rails","ruby","rubygems"],"campaign_type":null,"search_a":"'33jm':20A,25A '95jc':19A,24A 'activ':3A,12A 'activestorage':26A 'advisori':2A 'analysi':15A 'arbitrari':6A 'duplic':1A 'file':7A 'ghsa':17A,22A 'ghsa-wgv4-95jc-33jm':16A,21A 'imag':14A 'possibl':5A 'read':10A 'storag':4A,13A 'wgv4':18A,23A 'write':8A","search_b":"'-1188':29B 'activ':58B 'activestorag':27B 'advisori':35B 'analyz':62B 'attach':68B 'attack':72B 'base':85B 'cwe':28B 'duplic':40B 'f3w6':44B 'file':66B,76B 'fwh9':46B 'ghsa':43B 'ghsa-f3w6-w445-fwh9':42B 'imagemagick':30B,61B 'key':84B 'let':70B 'live':49B 'one':53B 'origin':55B 'packag':31B 'rail':32B 'read':73B,82B 'record':50B 'rubi':33B 'run':63B 'say':57B 'secret':83B 'server':79B 'storag':59B 'text':56B 'w445':45B 'withdrawn':37B 'write':75B","search_c":"'8.1.4.1':118C 'activestorag':115C 'advisori':87C,89C 'allow':129C 'analyz':143C 'attach':125C,149C 'base':139C 'block':159C 'descript':113C 'duplic':86C,97C 'e.g':135C 'extern':110C 'f3w6':101C 'file':147C 'function':161C 'fwh9':103C 'gem':116C 'ghsa':100C 'ghsa-f3w6-w445-fwh9':99C 'imagemagick':124C,142C,155C 'key':138C 'link':105C 'maintain':107C 'occur':127C 'oper':134C 'origin':112C 'polici':157C 'preserv':109C 'process':126C 'rail':122C 'read':131C,136C 'refer':111C 'rubi':120C 'run':144C 'secret':137C 'secur':156C 'server':130C 'unintend':160C 'w445':102C 'withdrawn':92C 'write':133C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-04T15:32:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-wgv4-95jc-33jm","url":"https://github.com/advisories/GHSA-wgv4-95jc-33jm","severity":"critical","published_at":"2026-11-04T15:32:31+00:00","modified_at":"2026-11-12T23:46:27+00:00","first_seen_at":"2026-11-12T23:49:07+00:00","fetched_at":"2026-11-12T23:49:07+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}