Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads

[Starburst-David]

A critical flaw in Ruby on Rails could allow an unauthenticated attacker to write arbitrary files on an app's server by uploading a crafted file if the app processes uploads using ImageMagick. The Rails project disclosed the flaw in an advisory and fixed it in versions 8.1.4.1 and 8.0.5.2.

The flaw is in Active Storage, the part of Rails that handles file uploads. Some apps store uploaded files using Active Storage's Disk service, which stores them on the server's disk. In those apps, an attacker could also read any file the app can read.

Those files typically include the app's secret_key_base and its credentials for other systems, according to Rails. Reading them may in turn allow remote code execution or lateral movement into those systems.

Rails rates the flaw 9.8 out of 10 on the CVSS scale. It is tracked as GHSA-f3w6-w445-fwh9 and does not yet have a CVE identifier.

ImageMagick selects a format handler, which it calls a coder, based on the file's content. Some coders act on other files named inside the image, not on the image itself. Active Storage imposes no limits on which coders an upload can use, so the server's own ImageMagick policy was the only limit.

Full article at:
https://thehackernews.com/2026/11/criti ... ckers.html

Published Date: Nov 04, 2026

Vulnerabilities has been mentioned in this article:
CVE-2026-66066