Ruby on Rails has disclosed a critical vulnerability in Active Storage, the component that handles file uploads, that can let an unauthenticated attacker write arbitrary files on an application's server simply by uploading a crafted file. The flaw is tracked as GHSA-f3w6-w445-fwh9 and rated 9.8 out of 10 on the CVSS scale. It was fixed in Rails 8.0.5.2 and 8.1.4.1, released on 4 November 2026; Canada's Centre for Cyber Security issued advisory AV26-1129 on 5 November. No CVE number has been assigned in the sources used here, so this post uses the GHSA identifier only.

How one upload becomes a server compromise

The attack works when an application processes uploads with ImageMagick through MiniMagick, the default for apps built on load_defaults 6.1 or earlier. A crafted file can reach an unsafe ImageMagick coder during image analysis, and the server then writes files the attacker chooses. Where attachments use Active Storage's Disk service, the same path can also read arbitrary files the application process can read — including secret_key_base, database passwords and third-party tokens. Rails says one attack chain was reported to it, but not that the flaw has been exploited in the wild.

What to do

Every Active Storage version before 8.0.5.2 is affected, as are 8.1 versions before 8.1.4.1; older release series are unsupported and will receive no fix. The two releases address 21 security issues, including a second high-severity Active Storage flaw (GHSA-v924-7rp8-4mxh, CVSS 8.8). The fix ships an ImageMagick security policy Rails applies to every ImageMagick process MiniMagick starts. Rails strongly recommends upgrading immediately, and Disk service users should rotate secret_key_base and every other secret the application process can read. Rails 8.0 support ends on 7 November 2026, so older lines need a migration plan.

Sources: Dark Reading, Critical Rails bug derail vulnerable servers, 4–5 November 2026; iSec News, Rails security update — 21 vulnerabilities, 5 November 2026; Abijita, Rails ActiveStorage ImageMagick file-write flaw, 5 November 2026.