Rails Active Storage before 8.0.5.2 and 8.1.4.1 can read and write files
Original title: Rubyonrails security advisory (AV26-1129)
The November 5 advisory covers image-analysis file access and points to rails releases 8.0.5.2 and 8.1.4.1.
The Canadian Centre for Cyber Security advisory AV26-1129 says Ruby on Rails Active Storage before 8.0.5.2 and before 8.1.4.1 is affected by possible arbitrary file write and read in image analysis. Fixes are published as rails releases 8.0.5.2 and 8.1.4.1. The notice urges administrators to review those releases and apply updates. It does not mention exploitation.
Unconfirmed: The advisory calls the file write and read possible and gives no exploitation status.
- Advisory AV26-1129 is dated November 5, 2026, citing status as of November 4.
- Affected ranges are prior to 8.0.5.2 and prior to 8.1.4.1.
- The stated issue is in Active Storage image analysis.
- The Cyber Centre links the rails/rails release pages for both fixes.
Impact: Possible arbitrary file write and read
| Product | Affected | Fixed in |
|---|---|---|
| Ruby on Rails Active Storage | Prior to 8.0.5.2 | 8.0.5.2 |
| Ruby on Rails Active Storage | Prior to 8.1.4.1 | 8.1.4.1 |
- 1.Update Active Storage to 8.0.5.2 or 8.1.4.1, depending on the installed line.
- Vendors
- Ruby on Rails
- Products
- Active Storage
- Organizations
- Canadian Centre for Cyber Security
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-1129 Date: November 5, 2026 As of November 4, 2026, Rubyonrails is affected by a vulnerability in the following product: Active Storage Prior to 8. 0. 5.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.