Critical Ruby on Rails Active Storage Flaw Enables Unauthenticated Arbitrary File Write via ImageMagick Uploads
Ruby on Rails disclosed a critical vulnerability (GHSA-f3w6-w445-fwh9, CVSS 9.8) in Active Storage that lets an unauthenticated attacker write arbitrary files on an app's server by uploading a crafted file when the app processes uploads with ImageMagick. Apps that store uploads using Active Storage's Disk service can also have arbitrary files read, exposing secrets such as secret_key_base and credentials, which can enable remote code execution or lateral movement. The flaw stems from Active Storage's ImageMagick analyzer invoking ImageMagick's MSL coder without restricting which coders can be used, reachable simply by attaching an uploaded file (no variant or preview generation required). Rails fixed the issue, along with a second high-severity flaw (GHSA-v924-7rp8-4mxh, CVSS 8.8) affecting ImageMagick/FFmpeg decoder selection via filename extensions, in versions 8.1.4.1 and 8.0.5.2, which together patch 21 security issues. The researcher RyotaK of GMO Flatt Security reported the issue via HackerOne; Rails says one exploitation chain was reported but has not confirmed whether the flaw has been exploited in the wild.
Entenda a falha
A vulnerabilidade
GHSA-f3w6-w445-fwh9 (CVSS 9.8, no CVE yet) is a flaw in Rails Active Storage. An unauthenticated attacker who uploads a crafted file can write arbitrary files on the server. If the app uses the Disk service, the attacker can also read any file the app can read, such as secret_key_base and credentials, which can lead to remote code execution or lateral movement. An app is affected only if it uses variant_processor = :mini_magick (the default before load_defaults 7.0), its ImageMagick policy does not block the coders involved (Debian and Ubuntu defaults do not), and it accepts uploads from untrusted users. All versions before 8.0.5.2, and 8.1 before 8.1.4.1, are affected. Fixed in 8.0.5.2 and 8.1.4.1, with mini_magick 5.1 or later. The second flaw, GHSA-v924-7rp8-4mxh (CVSS 8.8), lets an attacker who controls the filename and declared content type influence which ImageMagick or FFmpeg decoder processes the upload. It is fixed in the same releases.
Como funciona
When a file is attached, Active Storage's ImageMagick analyzer runs on it. No variant, preview or explicit analyze call is needed. ImageMagick picks a format handler, called a coder, from the file's content. An uploaded SVG reaches ImageMagick's MSL coder through the analyzer. MSL is a scripting coder that reads and writes files named inside its script. Active Storage places no limit on which coders may be used, so the only barrier is the server's ImageMagick policy. If that policy does not block MSL, the upload makes ImageMagick act on other files on the server's disk.
Por que é vulnerável
Active Storage's ImageMagick analyzer invoked ImageMagick without restricting which coders could be used. It trusted the system policy to block dangerous ones, and common distribution defaults do not. For the second flaw, uploads were passed to ImageMagick and FFmpeg under temporary names that kept the uploaded extension, and those tools can choose a decoder from the extension when the content does not reveal the format. The fix ships an ImageMagick policy that MiniMagick applies to its commands. It blocks the MSL coder, coders that read or delete other files, coders that fetch or display references, all Ghostscript coders and the gs delegate, and @filename indirection.
Onde está
The Active Storage ImageMagick analyzer, per the fixing commit the article cites (no hash given); the shipped policy is activestorage/lib/active_storage/image_magick/policy.xml.
Como foi descoberta
RyotaK, a researcher at GMO Flatt Security, reported the flaw through HackerOne. The Rails project disclosed it in a security advisory together with the fixed releases, which patch 21 security issues in total. Rails says one attack chain was reported but does not assume it is the only one. The advisory does not say whether the flaw has been exploited.
Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 10:15.
Detalhes técnicos
Apps are affected only if they use config.active_storage.variant_processor = :mini_magick (the default before Rails 7.0 load_defaults), their ImageMagick policy does not already block the vulnerable coders (Debian/Ubuntu defaults do not), and they accept uploads from untrusted users. All Active Storage versions before 8.0.5.2 and 8.1 versions before 8.1.4.1 are affected. This is distinct from the July 2026 flaw CVE-2026-66066, which affected apps using libvips rather than ImageMagick.
Remediação
Upgrade to Rails 8.1.4.1 or 8.0.5.2 and mini_magick 5.1+ as soon as possible. Verify the new ImageMagick policy loads correctly via MiniMagick.identify, and note it does not apply if the app overrides MiniMagick's CLI environment, or if it uses GraphicsMagick. Apps that cannot upgrade should manually block the MSL coder, Ghostscript coders, and the gs delegate in ImageMagick's system policy.xml. Apps using the Disk service should rotate secret_key_base, master keys, credentials.yml.enc contents, and all database/storage/third-party credentials the app process can read.
Linha do tempo
-
Critical Ruby on Rails Active Storage Flaw Enables Unauthenticated Arbitrary File Write via ImageMagick Uploads
ler a análise desta fonte ocultar
Ruby on Rails disclosed a critical vulnerability (GHSA-f3w6-w445-fwh9, CVSS 9.8) in Active Storage that lets an unauthenticated attacker write arbitrary files on an app's server by uploading a crafted file when the app processes uploads with ImageMagick. Apps that store uploads using Active Storage's Disk service can also have arbitrary files read, exposing secrets such as
secret_key_baseand credentials, which can enable remote code execution or lateral movement. The flaw stems from Active Storage's ImageMagick analyzer invoking ImageMagick's MSL coder without restricting which coders can be used, reachable simply by attaching an uploaded file (no variant or preview generation required). Rails fixed the issue, along with a second high-severity flaw (GHSA-v924-7rp8-4mxh, CVSS 8.8) affecting ImageMagick/FFmpeg decoder selection via filename extensions, in versions 8.1.4.1 and 8.0.5.2, which together patch 21 security issues. The researcher RyotaK of GMO Flatt Security reported the issue via HackerOne; Rails says one exploitation chain was reported but has not confirmed whether the flaw has been exploited in the wild.Technical Details
Apps are affected only if they use
config.active_storage.variant_processor = :mini_magick(the default before Rails 7.0load_defaults), their ImageMagick policy does not already block the vulnerable coders (Debian/Ubuntu defaults do not), and they accept uploads from untrusted users. All Active Storage versions before 8.0.5.2 and 8.1 versions before 8.1.4.1 are affected. This is distinct from the July 2026 flaw CVE-2026-66066, which affected apps using libvips rather than ImageMagick.Remediation
Upgrade to Rails 8.1.4.1 or 8.0.5.2 and mini_magick 5.1+ as soon as possible. Verify the new ImageMagick policy loads correctly via
MiniMagick.identify, and note it does not apply if the app overrides MiniMagick's CLI environment, or if it uses GraphicsMagick. Apps that cannot upgrade should manually block the MSL coder, Ghostscript coders, and thegsdelegate in ImageMagick's system policy.xml. Apps using the Disk service should rotatesecret_key_base, master keys,credentials.yml.enccontents, and all database/storage/third-party credentials the app process can read.