Rails Security Releases Fix Critical Active Storage Flaw

The Rails team has shipped emergency versions 8.0.5.2 and 8.1.4.1 after finding a critical hole in how Active Storage talks to ImageMagick. In a 4 November 2026 release note, Mike Dalessio said the updates address 21 security issues and that teams should upgrade as soon as possible.

The lead flaw is tracked as GHSA-f3w6-w445-fwh9. GitHub rates it Critical at CVSS 9.8. An unauthenticated attacker who can upload a crafted file may write arbitrary files on the server. If attachments use the Disk storage service, the same path can also read files the app process can see — including secret_key_base and credentials — which the advisory says may lead to remote code execution or lateral movement. Attaching the upload is enough; no separate analyse or preview call is required.

What the Rails security advisories cover

Affected packages are activestorage below 8.0.5.2, and 8.1.x below 8.1.4.1. Fixed releases are 8.0.5.2 and 8.1.4.1. A second High advisory, GHSA-v924-7rp8-4mxh, covers related Active Storage video preview, analysis and image-processing paths that can also read files or reach code execution.

The release notes group the rest of the 21 fixes into themes: Strong Parameters bypasses, IP spoofing via the Forwarded header on 8.1, several Action View XSS issues, denial-of-service paths, unsigned Content-Type and size limits on Google Cloud Storage direct uploads, session-handling bugs, cache poisoning and a Mailgun ingress signature replay. Security support for the 8.0 series ends on 7 November 2026, so teams still on older lines are being pushed hard toward a current 8.x release.

Who is affected and what to do

An app is affected when all of these are true: it uses ImageMagick for Active Storage variants (config.active_storage.variant_processor = :mini_magick, the default for load_defaults 6.1 or earlier); its ImageMagick policy leaves the dangerous coders allowed (Debian and Ubuntu packaged policies leave them allowed, the advisory says); and untrusted users can upload files.

Defensive steps from the advisory and release note:

• Upgrade activestorage (and the rest of Rails) to 8.0.5.2 or 8.1.4.1 now.
• If the variant processor is :mini_magick, run mini_magick 5.1 or newer so the shipped ImageMagick policy can be applied.
• If attachments use the Disk service and exposure is possible, rotate secret_key_base, the master key, everything in credentials.yml.enc, database and storage credentials, and third-party tokens. An exposed secret should not be retained as a fallback.
• Apps that must render PostScript or PDF through ImageMagick need to re-allow the gs delegate in the host policy after upgrading.
• If an immediate upgrade is impossible, copy the shipped policy rules into the system ImageMagick policy.xml, at least denying the MSL coder, Ghostscript coders and the gs delegate. Patch commits are linked from the advisory for 8.0 and 8.1.

Why upload parsers keep turning into RCE paths

ImageMagick’s willingness to pick a coder from file content, including ones that chase filenames inside the image, is an old class of bug. Active Storage did not constrain those coders, so a single attachment became a remote write — and on Disk storage, a read of the app’s secrets. That pattern mirrors other infrastructure flaws TSN has covered where a trusted helper library sits on an unauthenticated path, from Node-RED admin API abuse to Barracuda bugs that chain to root.

The timing also matters. Security support for Rails 8.0 ends on 7 November 2026, days after this drop. Teams that delay are choosing between an emergency patch and an unsupported line. Vendors that leave products unpatched after end-of-life, as with SonicWall’s GMS, show how quickly that choice becomes a permanent exposure. For Rails shops the practical next check is inventory: which apps still use :mini_magick, which store uploads on Disk, and whether any of those accept uploads from the public internet without an extra virus or type gate.

Sources

• Rails: Versions 8.0.5.2 and 8.1.4.1 have been released (4 November 2026)
• GitHub advisory GHSA-f3w6-w445-fwh9: Possible arbitrary file write and read in Active Storage image analysis

Related stories

• SonicWall Won’t Patch Two GMS Flaws as the Product Is End-of-Life
• Patch and Lock Down Node-RED as Attackers Exploit Admin API Flaw
• Barracuda Patches Two Vulnerabilities That Can Chain to Root
• Alpine OpenSSH Password Authentication Bypass Fixed