Critical Ruby on Rails Flaw Lets Hackers Steal Server Secrets Through Malicious Image Uploads
Original title: Critical Ruby on Rails Flaw Could Let Hackers Steal Server Secrets Through Malicious Image Uploads
Unauthenticated image uploads via Active Storage can read and write server files in default ImageMagick setups; fixed in Rails 8.0.5.2 and 8.1.4.1 with a security policy.
Ruby on Rails Active Storage has a critical flaw allowing unauthenticated users to upload crafted images that make the server read or write files when using the Disk service. The Rails team rates the bug Critical with a CVSS score of 9.8 and published the advisory on November 4, 2026. The flaw stems from ImageMagick's coder selection based on file content. Affected versions are activestorage before 8.0.5.2 and 8.1 releases before 8.1.4.1. The fix adds an ImageMagick security policy to block specific coders and indirection.
Unconfirmed: One attack chain reported but Rails team does not assume it is the only one; no CVE ID assigned yet.
- App affected only if using ImageMagick via config.active_storage.variant_processor = :mini_magick
- Fix ships ImageMagick security policy blocking MSL scripting coder, file read/delete coders, remote/local references, Ghostscript coders, and @filename indirection
- One attack chain reported but Rails team does not assume it is the only one
- Previous similar flaw in CVE-2026-66066 was exploited in real attacks
- Security support for 8.0 series ends November 7, 2026
Impact: read and write server files including secrets like secret_key_base
- 1.Upgrade to activestorage 8.0.5.2 or 8.1.4.1
- 2.Update to mini_magick 5.1 or newer
- 3.Apply ImageMagick security policy blocking MSL, file read/delete coders, Ghostscript coders, and gs delegate
- Vendors
- Ruby on Rails
- Products
- Active Storage
- Organizations
- Rails team
From the original article
4 min read at cybersecuritynews.com
A critical flaw in Ruby on Rails Active Storage lets an unauthenticated user upload a crafted image and make the server write files. If uploads use the Disk service, the same upload can make the server read files too. The Rails team rated the bug Critical, with a CVSS score of 9.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.