{"id":"TECH-202611-ektjqm","kind":"technique","aliases":[],"related":[],"title":"Rails Active Storage flaw lets anyone who can upload a file write files on the server, and read secrets like secret_key_base, in apps using ImageMagick (GHSA-f3w6-w445-fwh9, fixed in 8.1.4.1 / 8.0.5.2, no CVE yet)","description":null,"summary":"Rails disclosed GHSA-f3w6-w445-fwh9 (CVSS 9.8, no CVE yet) on 3 Nov 2026, fixed in Rails 8.1.4.1 and 8.0.5.2. Active Storage's ImageMagick analyzer runs as soon as an upload is attached; nothing limits which ImageMagick coders the file can reach, so a crafted upload (e.g. an SVG reaching the MSL scripting coder) lets an unauthenticated attacker write arbitrary files on the server. Apps that store attachments with the Disk service can also have any file the app can read taken, including secret_key_base and credentials, which can lead to remote code execution or lateral movement. Affected: apps using :mini_magick (the default for load_defaults 6.1 or earlier) that accept untrusted uploads and whose ImageMagick policy does not block these coders (the Debian and Ubuntu default policies do not). Every Active Storage before 8.0.5.2 and 8.1 before 8.1.4.1; series older than 8.0 get no fix. The same releases fix GHSA-v924-7rp8-4mxh (CVSS 8.8): the upload's filename extension picks the FFmpeg/ImageMagick decoder, which can leak files and on some FFmpeg builds run code. Reported by RyotaK (GMO Flatt Security). Exploitation in the wild: unknown.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"activestorage","fixed":["8.0.5.2","8.1.4.1"],"affected":"< 8.0.5.2, >= 8.1.0 < 8.1.4.1","ecosystem":"rubygems"},{"name":"Ruby on Rails","fixed":["8.0.5.2","8.1.4.1"],"affected":"< 8.0.5.2, >= 8.1.0 < 8.1.4.1","ecosystem":"rubygems"}],"ecosystems":[],"tags":["early-warning","technique"],"not_affected_if":[],"how_to_check":"- Gemfile.lock: activestorage / rails below 8.0.5.2, or 8.1.x below 8.1.4.1\n- config.active_storage.variant_processor = :mini_magick, or not set with load_defaults below 7.0 (the default is then :mini_magick)\n- App accepts file uploads from untrusted users\n- Server ImageMagick policy.xml does not block the MSL coder, the Ghostscript coders and the gs delegate (stock Debian/Ubuntu policies do not); a wildcard allow rule such as pattern=\"*\" overrides blocks\n- Attachments stored with the Disk service: secrets may have been readable\n- Signs of past exploitation: unknown (the advisory gives none)","fix":"- Upgrade to Rails 8.1.4.1 or 8.0.5.2; :mini_magick apps also need mini_magick 5.1 or later\n- Confirm the shipped policy is loaded: bin/rails runner 'puts MiniMagick.identify { |i| i.list \"policy\" }' (it does not apply if the app replaces MiniMagick.cli_env, uses cli_prefix or a custom MiniMagick::Shell; GraphicsMagick gets no protection)\n- Cannot upgrade, or on Rails older than 8.0: copy activestorage/lib/active_storage/image_magick/policy.xml rules into the system ImageMagick policy (e.g. /etc/ImageMagick-7/policy.xml); at minimum block MSL, the Ghostscript coders and the gs delegate\n- Disk service apps: rotate secret_key_base, the master key, everything in config/credentials.yml.enc, storage and database credentials and third-party tokens; do not keep old secrets as fallbacks\n- Rails 8.0 security support ends 7 Nov 2026: plan the move to 8.1","status":"open","published_at":null,"first_seen_at":"2026-11-04T13:04:31+00:00","triaged_at":"2026-11-04T13:04:31+00:00","updated_at":"2026-11-04T13:05:05+00:00","category":"package","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':41A '2026':66B '3':64B '4mxh':209B '6.1':161B '7rp8':208B '8.0':197B '8.0.5.2':36A,72B,189B '8.1':191B '8.1.4.1':35A,70B,193B '8.8':211B '9.8':59B 'accept':165B 'activ':2A,73B,186B 'activestorage':43A 'affect':151B 'also':126B 'analyz':77B 'anyon':6A 'app':25A,117B,131B,152B 'arbitrari':112B 'attach':85B,120B 'attack':110B 'base':23A,138B 'block':174B 'build':229B 'code':146B,231B 'coder':90B,106B,176B 'craft':97B 'credenti':140B 'cve':38A,61B 'cvss':58B,210B 'debian':178B 'decod':220B 'default':157B,160B,181B 'disclos':52B 'disk':123B 'e.g':99B 'earli':48B 'earlier':163B 'early-warn':47B 'ektjqm':42A 'everi':185B 'execut':147B 'exploit':238B 'extens':216B 'f3w6':30A,55B 'ffmpeg':228B 'ffmpeg/imagemagick':219B 'file':11A,13A,92B,113B,129B,224B 'filenam':215B 'fix':33A,67B,200B,204B 'flatt':236B 'flaw':4A 'fwh9':32A,57B 'get':198B 'ghsa':29A,54B,206B 'ghsa-f3w6-w445-fwh9':28A,53B 'ghsa-v924-7rp8-4mxh':205B 'gmo':235B 'imagemagick':27A,76B,89B,170B 'includ':135B 'key':22A,137B 'later':149B 'lead':143B 'leak':223B 'let':5A,107B 'like':20A 'limit':87B 'load':159B 'magick':155B 'mini':154B 'movement':150B 'msl':104B 'noth':86B 'nov':65B 'older':195B 'on':45A 'pick':217B 'polici':171B,182B 'rail':1A,51B,69B 'rails':46A 'reach':94B,102B 'read':18A,133B 'releas':203B 'remot':145B 'report':232B 'ruby':44A 'run':78B,230B 'ryotak':234B 'script':105B 'secret':19A,21A,136B 'secur':237B 'seri':194B 'server':16A,116B 'servic':124B 'soon':80B 'storag':3A,74B,187B 'store':119B 'svg':101B 'taken':134B 'tech':40A 'techniqu':50B 'ubuntu':180B 'unauthent':109B 'unknown':242B 'untrust':166B 'upload':9A,83B,98B,167B,213B 'use':26A,153B 'v924':207B 'w445':31A,56B 'warn':49B 'whose':169B 'wild':241B 'write':12A,111B 'yet':39A,62B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["activestorage","rubyonrails"],"ptokens":["activestorage","on","rails","ruby"],"labels":["critical","earlywarning","package","technique"],"campaign_type":"exploitation","first_public_at":"2026-11-04T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202611-ektjqm","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-04T13:04:31+00:00","fetched_at":"2026-11-04T13:04:31+00:00","note":null}],"documents":[{"id":66863,"url":"https://x.com/TheHackersNews/status/2117957538905756008","title":"@TheHackersNews: ‼️ BREAKING - Critical Rails flaw (CVSS 9.8) could let unauthenticated attackers","kind":"post","source":"x","publisher":null,"text":"‼️ BREAKING - Critical Rails flaw (CVSS 9.8) could let unauthenticated attackers write arbitrary server files via crafted uploads.\n\nThe bug affects Active Storage apps using ImageMagick and could also expose application secrets in certain setups.\n\nRails patches are out.\n\nDetails: https://t.co/OkIG62NUWa\n\nlikes 74 reposts 25","published_at":"2026-11-04T12:30:01+00:00","relation":"describes","confidence":null,"note":null},{"id":67032,"url":"https://thehackernews.com/2026/11/critical-rails-flaw-lets-attackers.html","title":"Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads","kind":"blog","source":"analyst","publisher":null,"text":"Rails Active Storage GHSA-f3w6-w445-fwh9 (CVSS 9.8, no CVE): unauthenticated arbitrary file write via ImageMagick analyzer on attach (SVG reaching MSL coder); arbitrary file read with Disk service (secret_key_base, credentials). Affected: Active Storage < 8.0.5.2 and 8.1 < 8.1.4.1 using :mini_magick (default for load_defaults <= 6.1), without an ImageMagick policy blocking the coders (Debian/Ubuntu policies do not), accepting untrusted uploads. Fixed 8.1.4.1 / 8.0.5.2 (needs mini_magick >= 5.1); <8.0 unsupported. Also GHSA-v924-7rp8-4mxh (8.8) FFmpeg/ImageMagick decoder chosen by filename extension. Reported by RyotaK (GMO Flatt Security). Exploitation not stated.","published_at":"2026-11-04T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}