Rails Active Storage before 8.0.5.2 and 8.1.4.1 can read and write files
The November 5 advisory covers image-analysis file access and points to rails releases 8.0.5.2 and 8.1.4.1.
Stories per day · 30 days
1 RSS
3 stories, newest first · one card per story
Stories tagged #active-storage
Rails flaw lets attackers write files via ImageMagick uploads
Ruby on Rails Active Storage before 8.1.4.1 and 8.0.5.2 allows arbitrary file write and read of secrets via crafted uploads processed by ImageMagick.
2
KindaRails2Shell threatens Ruby on Rails apps (CVE-2026-66066)
Critical CVE-2026-66066 in Rails' Active Storage/libvips allows unauthenticated arbitrary file read and possible RCE; active exploitation now observed.
5