Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitycriticalExploited in the wild

Critical Ruby on Rails Flaw Could Let Hackers Steal Server Secrets Through Malicious Image Uploads

4 sources · 4 articlesFirst reported Updated ()1
Merged summary · from the lead articleSummaries by Vani AI

Unauthenticated image uploads via Active Storage can read and write server files in default ImageMagick setups; fixed in Rails 8.0.5.2 and 8.1.4.1 with a security policy.

Ruby on Rails Active Storage has a critical flaw allowing unauthenticated users to upload crafted images that make the server read or write files when using the Disk service. The Rails team rates the bug Critical with a CVSS score of 9.8 and published the advisory on November 4, 2026. The flaw stems from ImageMagick's coder selection based on file content. Affected versions are activestorage before 8.0.5.2 and 8.1 releases before 8.1.4.1. The fix adds an ImageMagick security policy to block specific coders and indirection.

Key facts
  • App affected only if using ImageMagick via config.active_storage.variant_processor = :mini_magick
  • Fix ships ImageMagick security policy blocking MSL scripting coder, file read/delete coders, remote/local references, Ghostscript coders, and @filename indirection
  • One attack chain reported but Rails team does not assume it is the only one
  • Previous similar flaw in CVE-2026-66066 was exploited in real attacks
  • Security support for 8.0 series ends November 7, 2026
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Vendors
Ruby on RailsRails
Products
Active StorageImageMagick
Organizations
Rails teamCanadian Centre for Cyber Security

Coverage

oldest first · one row per article · UTC
  1. · 5d ago The Hacker NewsFirst report

    Rails flaw lets attackers write files via ImageMagick uploads

    Ruby on Rails Active Storage before 8.1.4.1 and 8.0.5.2 allows arbitrary file write and read of secrets via crafted uploads processed by ImageMagick.

  2. · 5d ago Cyber Security News

    Critical Ruby on Rails Flaw Lets Hackers Steal Server Secrets Through Malicious Image Uploads

    Unauthenticated image uploads via Active Storage can read and write server files in default ImageMagick setups; fixed in Rails 8.0.5.2 and 8.1.4.1 with a security policy.

  3. · 4d ago Dark Reading

    Critical Rails Bug Threatens to Derail Vulnerable Servers

    Rails Active Storage ImageMagick integration allows arbitrary file read and write.

  4. · 4d ago Canadian Centre for Cyber Security

    Rails Active Storage before 8.0.5.2 and 8.1.4.1 can read and write files

    The November 5 advisory covers image-analysis file access and points to rails releases 8.0.5.2 and 8.1.4.1.