# Critical Ruby on Rails Flaw Enables Arbitrary File Write via ImageMagick Unauthenticated attackers can exploit Active Storage to execute remote code or access sensitive system credentials. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-11-04 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/ce7749b2-339f-4167-b816-8975e33791df ## Critical Active Storage Vulnerability A severe security flaw in Ruby on Rails allows unauthenticated attackers to perform arbitrary file writes on application servers. The vulnerability resides within Active Storage, specifically when processing file uploads via ImageMagick. This flaw, tracked as GHSA-f3w6-w445-fwh9, carries a critical CVSS score of 9.8, necessitating immediate attention from all Rails developers. ## Exploitation via MSL Coder The vulnerability stems from Active Storage failing to restrict ImageMagick coder selection. Attackers can upload crafted SVG files that trigger the MSL coder, a scripting tool capable of reading and writing arbitrary files. Because the analyzer executes upon attachment, no complex variant generation or preview processing is required to trigger the exploit. ## Impact on System Credentials Beyond file writes, the flaw enables attackers to read sensitive files, including the application's secret_key_base and system credentials. Accessing these files facilitates lateral movement into integrated systems or potential remote code execution. The Rails advisory highlights that while one attack chain was reported, other undisclosed exploitation methods may currently exist in production. ## Affected Versions and Requirements All Active Storage versions prior to 8.0.5.2 and 8.1 versions before 8.1.4.1 are affected. An application is vulnerable if it utilizes ImageMagick for processing and stores files on the local disk. Older, unsupported Rails release series will not receive patches, leaving those legacy systems exposed to this critical security risk without official remediation. ## Secondary Vulnerability Discovered The same security releases also address a second high-severity flaw, GHSA-v924-7rp8-4mxh, rated 8.8 on the CVSS scale. This issue involves Active Storage passing uploads to ImageMagick and FFmpeg with original file extensions. Attackers can manipulate the decoder selection by controlling the filename and declared content type, bypassing intended security boundaries during the file processing stage. ## Remediation Through Security Policies The fixed versions introduce a robust ImageMagick security policy enforced via the MiniMagick gem. This policy explicitly blocks the MSL coder, Ghostscript-backed coders, and various file-reading or remote-fetching operations. By applying these restrictions globally to all commands, the update prevents attackers from leveraging ImageMagick's advanced features to manipulate server-side files or system resources. ## Historical Context of Flaws This incident follows a July security patch for CVE-2026-66066, which targeted applications using libvips. While that previous flaw did not impact ImageMagick users, the current vulnerability specifically targets the ImageMagick integration. Rails developers must distinguish between these two distinct attack paths to ensure their specific infrastructure configuration is adequately protected against evolving threats. ## Immediate Action Required Rails strongly recommends upgrading to the latest patched versions immediately to mitigate these 21 combined security issues. The advisory does not provide specific indicators for detecting past exploitation, making proactive patching the primary defense. Security teams should prioritize this update to prevent unauthorized file access and potential full system compromise via Active Storage. ## Sources covering this story - https://thehackernews.com/2026/11/critical-rails-flaw-lets-attackers.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._