The Ruby on Rails project has fixed a critical flaw in Active Storage, the part of Rails that handles file uploads. If an app uses ImageMagick to process uploads, an unauthenticated attacker who can upload a crafted file may be able to write arbitrary files on the server. Rails rates it 9.8 out of 10. The advisory is tracked as GHSA-f3w6-w445-fwh9 and had no CVE identifier at the time of The Hacker News’s report.
Rails says that attaching the upload is enough to reach the flaw: the app does not have to create an image variant or preview. When uploads are stored with Active Storage’s Disk service, the attacker may also be able to read any file the app process can read. Rails notes those files typically include secret_key_base and credentials for other systems, which could lead to remote code execution or movement into those systems. One attack chain was reported to the project, and Rails says it does not assume it is the only one. The advisory does not say whether the flaw has been exploited. The researcher RyotaK of GMO Flatt Security reported it through HackerOne, per The Hacker News.
This is a different flaw from the one Rails fixed in July. CVE-2026-66066 affected apps using libvips, which Rails says are not exposed to this attack path, while apps using ImageMagick can be.
How to check if you’re affected
Affected versions are Active Storage releases before 8.0.5.2, and the 8.1 series before 8.1.4.1. Rails will not release fixed versions for series older than 8.0. According to the advisory, an app is affected only if all three of these are true:
- It uses ImageMagick for Active Storage image processing. That is
config.active_storage.variant_processor = :mini_magick, the default for apps onload_defaults6.1 or earlier. If the setting is not present, The Hacker News says the default is:mini_magickbeforeload_defaults7.0 and:vipsfrom 7.0 on. - Its ImageMagick security policy does not already deny the coders involved. Rails says the policies that Debian and Ubuntu ship do not.
- It accepts file uploads from untrusted users.
The fix is to upgrade to Rails 8.0.5.2 or 8.1.4.1. The fixed versions ship an ImageMagick security policy that denies the MSL scripting coder and other file-reading, remote-fetching and Ghostscript-backed coders. Applying it requires mini_magick 5.1 or later; with an older mini_magick, an app using :mini_magick raises an exception at boot. Apps that render PostScript or PDF through ImageMagick must re-allow the gs delegate and the coders they use in the host’s policy.xml, per the advisory.