Ruby on Rails fixes 21 flaws – a crafted image upload can make ImageMagick write and read server files

What happened

On 4 November 2026 the Ruby on Rails team released security versions 8.1.4.1 and 8.0.5.2. They fix 21 issues across the framework – Active Storage, Action Pack, Action View, Active Support and Action Mailbox – and the team strongly recommends upgrading as soon as possible. No CVE IDs have been assigned yet; each issue has a GitHub security advisory (GHSA).

The most serious is GHSA-f3w6-w445-fwh9 in Active Storage, the Rails component that handles uploaded files. Slovakia's national CERT, SK-CERT, rated it critical in warning V20261109-01 on 9 November. Neither Rails nor SK-CERT reports exploitation.

Technical details

The critical flaw (GHSA-f3w6-w445-fwh9). When a file is attached to a record, Active Storage analyses it straight away – for images, with ImageMagick. ImageMagick picks the coder that reads a file based on its content, not its extension, and some coders act on other files referenced inside the image. A crafted upload can therefore make ImageMagick write arbitrary files on the server. If attachments are stored with the Disk service, the attacker can also read files the app has access to, such as secret_key_base or credentials for other services. Attaching the file is enough; no variant, preview or explicit analysis call is needed.

Rails says one attack chain was reported but doesn't assume it's the only one. So instead of blocking a single trick, the fix ships an ImageMagick security policy (policy.xml). It denies the MSL coder, coders that read or delete other files, fetch remote or local references or draw to a screen, every Ghostscript-backed coder plus the gs delegate, and @filename indirection. ImageMagick reads every policy on its search path, so this one is added on top of the host policy and applies to all ImageMagick commands that mini_magick spawns.

The second Active Storage flaw (GHSA-v924-7rp8-4mxh, CVSS 3.1 8.8, high). Temporary files kept the extension from the uploaded filename, which the user controls. ffprobe (video and audio analysis), ffmpeg (video previews) and ImageMagick then chose decoders based on it. If FFmpeg is built with AviSynth support – the advisory says GPL builds for Windows and Linux from ffmpeg.org have it, while upstream defaults and common Linux distribution and Homebrew packages don't – an uploaded .avs file can disclose files through the preview image, or even lead to code execution in the FFmpeg process. Unlike the critical flaw, its score assumes an authenticated attacker. The fix keeps the extension only if it matches the detected content type.

Other high-severity issues: a Strong Parameters bypass via Parameters#each_key (GHSA-wm3x-v3qw-4jh3, CVSS 7.5 – an incomplete fix of CVE-2020-8164, exploitable only if the app passes the result of each_key into mass assignment), IP spoofing in RemoteIp (8.1 only) and a denial of service in safe_constantize. The rest are XSS issues in Action View helpers, denial-of-service bugs, and weaknesses in Google Cloud Storage direct uploads and session handling.

We don't publish exploitation details.

Who is affected

• Rails apps older than 8.1.4.1 (8.1 series) and older than 8.0.5.2 – per the advisory, that includes 7.2 and everything older.
• For the critical flaw, only apps that accept files from untrusted users and use Active Storage with ImageMagick (config.active_storage.variant_processor = :mini_magick, the default for load_defaults 6.1 and earlier) without a policy that denies the dangerous coders. The advisory says the packaged Debian and Ubuntu policies don't.
• File reads require the Disk service; file writes don't.
• Rails 7.2 and older won't get a fix: the maintenance policy lists security support only for 8.1 (until 10 October 2027) and 8.0 (until 7 November 2026, so already over).

How to tell if you were compromised

Neither Rails nor SK-CERT has published indicators of compromise. The checks below are our own suggestions:

• Uploaded files: look in Active Storage for attachments whose content doesn't match their type (PostScript, SVG or script text instead of an image) and for files with an .avs extension.
• File system: unexpected files written by the app's user, especially in code directories, public/ or the home directory.
• Processes: unusual child processes such as magick/convert, gs, ffmpeg or ffprobe, and shells spawned from them.
• Secret misuse: signed cookies that don't match real sessions, or unexpected activity on storage and database accounts.

What to do

1. Upgrade to Rails 8.1.4.1. The 8.0 series (8.0.5.2) won't receive further fixes, so plan the move to 8.1 soon.
2. Upgrade mini_magick to 5.1 or later – with :mini_magick, older versions raise an exception at boot after the Rails upgrade.
3. Make sure the policy actually applies. Apps that replace MiniMagick.cli_env after boot, clear the environment with MiniMagick.cli_prefix or install their own MiniMagick::Shell don't get the Rails policy and need the rules in ImageMagick's system policy. GraphicsMagick ignores ImageMagick policies.
4. If you can't upgrade yet (or you're on Rails 7.2 or older): copy the rules from the shipped policy.xml into the system policy, for example /etc/ImageMagick-7/policy.xml. At a minimum, deny the MSL coder, the gs delegate and the Ghostscript-backed coders (PS, PS2, PS3, EPS and variants, PDF, AI, EPDF, PDFA, POCKETMOD, XPS, PCL). For the extension flaw, you can temporarily remove VideoPreviewer, VideoAnalyzer and AudioAnalyzer from the Active Storage configuration, or use an FFmpeg build without AviSynth.
5. Rotate secrets if attachments are stored on disk (or the AviSynth conditions were met): secret_key_base, the master key, everything in config/credentials.yml.enc, storage and database credentials and third-party tokens. Don't keep the old key as a fallback, and expect users to be signed out.
6. Apps that need PDF or PostScript previews must explicitly re-allow the gs delegate and its coders in the system policy after upgrading – and should ask whether they really need to render those formats for anonymous users.

Timeline

Updates

• 10 November 2026 – first version of this article.