Rails Active Storage flaw lets anyone who can upload a file write files on the server, and read secrets like secret_key_base, in apps using ImageMagick (GHSA-f3w6-w445-fwh9, fixed in 8.1.4.1 / 8.0.5.2, no CVE yet)

Rails disclosed GHSA-f3w6-w445-fwh9 (CVSS 9.8, no CVE yet) on 3 Nov 2026, fixed in Rails 8.1.4.1 and 8.0.5.2. Active Storage's ImageMagick analyzer runs as soon as an upload is attached; nothing limits which ImageMagick coders the file can reach, so a crafted upload (e.g. an SVG reaching the MSL scripting coder) lets an unauthenticated attacker write arbitrary files on the server. Apps that store attachments with the Disk service can also have any file the app can read taken, including secret_key_base and credentials, which can lead to remote code execution or lateral movement. Affected: apps using :mini_magick (the default for load_defaults 6.1 or earlier) that accept untrusted uploads and whose ImageMagick policy does not block these coders (the Debian and Ubuntu default policies do not). Every Active Storage before 8.0.5.2 and 8.1 before 8.1.4.1; series older than 8.0 get no fix. The same releases fix GHSA-v924-7rp8-4mxh (CVSS 8.8): the upload's filename extension picks the FFmpeg/ImageMagick decoder, which can leak files and on some FFmpeg builds run code. Reported by RyotaK (GMO Flatt Security). Exploitation in the wild: unknown.