EN PT-BR
← Voltar ao feed
high

CERT-FR: 21 vulnerabilities fixed in Ruby on Rails 8.0.5.2 and 8.1.4.1, including critical Active Storage file write and RCE

1 fonte(s) · 1 atualização(ões) · publicado 03/11/2026 21:00 · coletado há 1 hora

CERT-FR advisory CERTFR-2026-AVI-1452 relays the Ruby on Rails security release of 4 November 2026. The release ships 8.0.5.2 and 8.1.4.1. CERT-FR says the flaws allow remote code execution, remote denial of service, confidentiality and integrity impact, security policy bypass and XSS. Affected versions are Rails 8.x before 8.1.4.1 and versions before 8.0.5.2. The advisory names no CVE IDs and does not mention exploitation.

Entenda a falha

A vulnerabilidade

Rails security release fixes 21 issues (1 critical, 4 high, 13 medium, 3 low), identified by GHSA IDs; the vendor announcement gives no CVE IDs. The most severe is GHSA-f3w6-w445-fwh9, an arbitrary file write and read in Active Storage image analysis. One secondary source rates it CVSS 9.8, says an unauthenticated attacker could trigger it with a crafted upload when the app uses ImageMagick, and lists it as CVE-2026-122006; the vendor did not confirm this. High issues: GHSA-v924-7rp8-4mxh (arbitrary file read and RCE in Active Storage video previews, analysis and image processing), GHSA-wm3x-v3qw-4jh3 (Strong Parameters bypass in Parameters#each_key), GHSA-2gff-2mmg-m73p (RemoteIp spoofing via the Forwarded header, 8.1 only) and GHSA-8474-xrp6-wh69 (DoS in safe_constantize). The rest are XSS, DoS, cache and session issues. Affected: Rails before 8.0.5.2 and 8.1 before 8.1.4.1; fixed in 8.0.5.2 and 8.1.4.1.

Como funciona

The articles do not describe the internals of each flaw. For the critical issue, the secondary source says a crafted file uploaded to an app is later processed by Active Storage image analysis with ImageMagick, and at that step the file system is reached in ways it should not be, allowing arbitrary files to be written and read. The Active Storage video preview and analysis issue is described only as leading to file read and RCE. No per-issue prerequisites are given by the vendor.

Por que é vulnerável

The articles do not state the root cause of any of the 21 issues. They only classify them (file write/read and RCE in Active Storage, a parameter filtering bypass, header-based IP spoofing, unbounded constant resolution leading to DoS, XSS, a missing SameSite attribute on session cookies). What the fixes change in code is not described.

Onde está

Named components only: Active Storage (image analysis, video previews), Parameters#each_key, RemoteIp, safe_constantize, CacheStore, Action View and Action Controller Live; no files or commits are named.

Como foi descoberta

The Rails team published the issues in a security release announcement on 4 November 2026, which CERT-FR relayed as advisory CERTFR-2026-AVI-1452. The announcement gives no credits, and neither it nor CERT-FR mentions exploitation. How the flaws were found is not stated.

Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 12:27.

Detalhes técnicos

The Rails announcement (discuss.rubyonrails.org) lists 21 issues by GHSA ID: 1 critical, 4 high, 13 medium and 3 low. The announcement gives no CVE IDs, credits or per-issue prerequisites.

  • Critical: GHSA-f3w6-w445-fwh9 is an arbitrary file write and read in Active Storage image analysis. One secondary source rates it CVSS 9.8 and says it is exploitable by an unauthenticated attacker through a crafted upload when the app processes images with ImageMagick. The same source lists it as CVE-2026-122006. This was not confirmed in the vendor announcement.
  • High: GHSA-v924-7rp8-4mxh covers arbitrary file read and RCE in Active Storage video previews, analysis and image processing. GHSA-wm3x-v3qw-4jh3 is a Strong Parameters bypass in Parameters#each_key. GHSA-2gff-2mmg-m73p is RemoteIp IP spoofing through the Forwarded header and affects 8.1 only. GHSA-8474-xrp6-wh69 is a DoS in safe_constantize.
  • Medium and low: These include several Action View XSS issues, Active Storage and Action Controller Live DoS, session restoration in CacheStore, cache poisoning through content negotiation, GCS direct-upload issues, a Mailgun signature replay and a missing SameSite attribute on session cookies.
  • Rails will not release fixes for series older than 8.0. Security support for 8.0 ends on 7 November 2026.

Remediação

Upgrade to Rails 8.0.5.2 or 8.1.4.1 as soon as possible, as the vendor recommends. Apps on :mini_magick also need mini_magick 5.1 or later, or they raise an error at boot (per a secondary source). Apps on unsupported series, such as 7.x, should move to a supported branch. Rails 8.0 reaches end of security support on 7 November 2026.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 03/11/2026 21:00 · coletado 06/11 12:00 primeiro registro

    CERT-FR: 21 vulnerabilities fixed in Ruby on Rails 8.0.5.2 and 8.1.4.1, including critical Active Storage file write and RCE

    ler a análise desta fonte

    CERT-FR advisory CERTFR-2026-AVI-1452 relays the Ruby on Rails security release of 4 November 2026. The release ships 8.0.5.2 and 8.1.4.1. CERT-FR says the flaws allow remote code execution, remote denial of service, confidentiality and integrity impact, security policy bypass and XSS. Affected versions are Rails 8.x before 8.1.4.1 and versions before 8.0.5.2. The advisory names no CVE IDs and does not mention exploitation.

    Technical Details

    The Rails announcement (discuss.rubyonrails.org) lists 21 issues by GHSA ID: 1 critical, 4 high, 13 medium and 3 low. The announcement gives no CVE IDs, credits or per-issue prerequisites.

    • Critical: GHSA-f3w6-w445-fwh9 is an arbitrary file write and read in Active Storage image analysis. One secondary source rates it CVSS 9.8 and says it is exploitable by an unauthenticated attacker through a crafted upload when the app processes images with ImageMagick. The same source lists it as CVE-2026-122006. This was not confirmed in the vendor announcement.
    • High: GHSA-v924-7rp8-4mxh covers arbitrary file read and RCE in Active Storage video previews, analysis and image processing. GHSA-wm3x-v3qw-4jh3 is a Strong Parameters bypass in Parameters#each_key. GHSA-2gff-2mmg-m73p is RemoteIp IP spoofing through the Forwarded header and affects 8.1 only. GHSA-8474-xrp6-wh69 is a DoS in safe_constantize.
    • Medium and low: These include several Action View XSS issues, Active Storage and Action Controller Live DoS, session restoration in CacheStore, cache poisoning through content negotiation, GCS direct-upload issues, a Mailgun signature replay and a missing SameSite attribute on session cookies.
    • Rails will not release fixes for series older than 8.0. Security support for 8.0 ends on 7 November 2026.

    Remediation

    Upgrade to Rails 8.0.5.2 or 8.1.4.1 as soon as possible, as the vendor recommends. Apps on :mini_magick also need mini_magick 5.1 or later, or they raise an error at boot (per a secondary source). Apps on unsupported series, such as 7.x, should move to a supported branch. Rails 8.0 reaches end of security support on 7 November 2026.