Rails Active Storage before 8.0.5.2 and 8.1.4.1 can read and write files
The November 5 advisory covers image-analysis file access and points to rails releases 8.0.5.2 and 8.1.4.1.
Stories per day · 30 days
2 RSS
Relatedactive-storage1activestorage1ao31arbitrary-file-write1fanfiction1image-analysis1imagemagick1image-uploads1otw1outage1rails1rails-security1
7 stories, newest first · one card per story
Stories tagged #ruby-on-rails
Critical Ruby on Rails Flaw Lets Hackers Steal Server Secrets Through Malicious Image Uploads
Unauthenticated image uploads via Active Storage can read and write server files in default ImageMagick setups; fixed in Rails 8.0.5.2 and 8.1.4.1 with a security policy.
1
Ruby on Rails 8.0.5.2 and 8.1.4.1 security releases
Ruby on Rails 8.0.5.2 and 8.1.4.1 have been released with security fixes.
AO3 outage tied to a security incident may last up to a month
OTW says restoration may take about two weeks and up to a month, and it does not expect data loss.
Ruby on Rails creator DHH says he's done writing code by hand
Ruby on Rails creator DHH says he stopped hand-writing code in March 2026 and now treats English as the language.
Attackers Exploit Critical Langflow and Rails Flaws in Credential
VulnCheck reports active exploitation of critical Langflow CVE-2026-0768 and Rails CVE-2026-66066 for credential harvesting, with detections rising to 360.
3
KindaRails2Shell threatens Ruby on Rails apps (CVE-2026-66066)
Critical CVE-2026-66066 in Rails' Active Storage/libvips allows unauthenticated arbitrary file read and possible RCE; active exploitation now observed.
5