Rails: Critical Flaw in Active Storage Uploads

On 4 November 2026 Ruby on Rails published a critical security advisory, scored 9.8 out of 10, for Active Storage, the part of Rails that handles uploaded files. It affects apps that process images with ImageMagick and accept uploads from anyone. The fixed versions are 8.1.4.1 and 8.0.5.2.

What we know

What can happen: according to the Rails advisory, an attacker with no account could write files on the server. If attachments use the Disk service (stored on the server itself), they could also read files the app can read, including keys and credentials.
When you're affected: the advisory requires all three: the app uses ImageMagick for Active Storage images; the server's ImageMagick security policy doesn't block certain formats (the advisory says the policies shipped by Debian and Ubuntu don't); and the app lets untrusted users upload files.
Which versions: activestorage before 8.0.5.2, and the 8.1 series before 8.1.4.1. Series older than 8.0 are no longer supported by Rails.
Who found it: the advisory credits researcher ryotak via HackerOne. The Hacker News says he works at GMO Flatt Security.
Is it exploited: the advisory doesn't say so. It does say one specific attack chain was reported and the maintainers don't assume it is the only one.
A second flaw: The Hacker News cites another Rails advisory, rated High (8.8), about temporary file names, fixed in the same releases.

What changes and what doesn't

It changes things for anyone running a Rails app that processes images uploaded by customers, users or visitors: update now or, if you can't, harden the ImageMagick policy as the advisory explains.
Older apps especially: ImageMagick is the default processor for apps configured with `load_defaults 6.1` or earlier. According to The Hacker News, since Rails 7.0 the default is vips, so a newer app may not be exposed unless someone switched it; the official Active Storage guide only says the default depends on `load_defaults`.
Nothing changes for sites built on WordPress, Drupal or other CMSs: this is a Rails flaw.

How to tell if you're affected

If you maintain the app:

Does it use ImageMagick? Look for `variant_processor` in the config. If it says `:mini_magick`, or the app runs `load_defaults 6.1` or earlier without overriding it, the answer is yes.
Can anyone upload files? Contact forms with attachments, profile photos, customer documents: if an untrusted user can upload, the answer is yes.
If both are yes, update today to 8.1.4.1 or 8.0.5.2. The advisory also asks for mini_magick 5.1 or later.
If you can't update yet, apply the deny rules the advisory gives to the server's ImageMagick policy.
If attachments live on the server's disk and you were exposed, rotate `secret_key_base` and any other secrets the app can read. The advisory says not to keep the old ones as fallbacks.

If you own the business and someone else maintains the app:

Ask in writing: «Does our app use Rails and Active Storage with ImageMagick? Is it on 8.1.4.1 or 8.0.5.2 yet? If we store files on the server, have you rotated the keys?».

Sources

Updates: if the flaw gets a CVE or attacks are confirmed, it will be added here with a link.