If you run a Rails app that takes uploads, check your version today. This morning, November 4, the Rails team released two security updates \u2014 8.1.4.1 and 8.0.5.2 \u2014 fixing 21 security issues at once. At the top is a critical flaw in Active Storage, the part of Rails that handles uploads, rated 9.8 out of 10.<\/p>\n
The worst issue is tracked as GHSA-f3w6-w445-fwh9. It has no CVE number yet \u2014 the GHSA identifier is the one to use. The Hacker News, summarizing the advisory, describes it this way: an unauthenticated attacker can write arbitrary files on an app’s server by uploading a crafted file, if the app processes uploads using ImageMagick.<\/p>\n
The mechanism, in plain terms: ImageMagick picks a format handler \u2014 it calls them coders \u2014 based on a file’s content, not just its extension. Some coders act on other files named inside the image instead of on the image itself. Active Storage put no limits on which coders an upload could use, so the server’s own ImageMagick policy was the only limit. According to the fix commit described by The Hacker News, an uploaded SVG reached ImageMagick’s MSL coder through the analyzer \u2014 MSL is a scripting coder that reads and writes files named by its script.<\/p>\n
Two details make this worse. First, the analyzer runs when a file is attached. Attaching the upload is enough; the app does not have to make a variant, a preview, or an explicit analyze call. Second, if your app stores attachments with Active Storage’s Disk service, an attacker may also be able to read any file the app can read. Rails says those files typically include the app’s secret_key_base and its credentials for other systems, and reading them may in turn allow remote code execution or movement into those systems.<\/p>\n
The same releases fix a second Active Storage flaw, GHSA-v924-7rp8-4mxh, rated High at 8.8, involving possible file read and remote code execution in video previews, analysis, and image processing. The announcement also lists a Strong Parameters bypass, IP spoofing in 8.1 only, several cross-site scripting flaws, denial-of-service issues, and session handling problems among the 21.<\/p>\n
Bad for the apps it hits, and narrower than the headline suggests. An app is affected only if all three are true: it uses ImageMagick for Active Storage \u2014 the If your app uses the vips processor \u2014 the default from load_defaults 7.0 on \u2014 this attack path is not yours. You still need the update for the other 20 fixes, but you are not standing in front of the 9.8.<\/p>\n Now the part I will not hype. The advisory, as reported, does not say this flaw has been exploited in the wild. Rails said one attack chain was reported to it, and that it does “not assume it is the only one that exists.” This is a researcher-found bug \u2014 reported through HackerOne by RyotaK of GMO Flatt Security \u2014 patched on disclosure, not a CISA known-exploited listing like the WordPress flaw I wrote about on Monday. Patch it like it matters, because a public advisory is also a map for attackers, but do not tell yourself you have already been breached.<\/p>\n Security support for the Rails 8.0 series ends on November 7, 2026 \u2014 three days after this release. The announcement says older versions are unsupported and recommends upgrading to at least the 8.0 series. If you are on 8.0, 8.0.5.2 is very likely your last safety net, and your real job this month is moving to 8.1. Older than 8.0, no fixed version is coming at all.<\/p>\n First, upgrade to Rails 8.1.4.1 or 8.0.5.2. If your app uses Second, verify the new protection actually reached your app. The fixed versions ship a restrictive ImageMagick policy blocking the MSL coder, coders that read or delete other files, coders that fetch remote or local references, the Ghostscript-backed coders and the gs delegate, and @filename indirection. The Hacker News lists the check from the Active Storage guide: run Third, if you cannot upgrade today, use Rails’ workaround: copy the shipped policy file’s rules from the activestorage gem into ImageMagick’s system policy, at minimum blocking the MSL coder, the Ghostscript coders, and the gs delegate.<\/p>\n Fourth, if your app stores attachments on disk, think about secrets. If that read path was open to untrusted uploads, change secret_key_base and every other secret the app can read \u2014 master key, encrypted credentials, storage and database credentials, and third-party tokens \u2014 and do not keep an exposed secret as a fallback.<\/p>\n My bottom line: check which processor you run, upgrade before the weekend, confirm the policy loaded, and if you are still on 8.0, start the move to 8.1 now. November 7 is three days away.<\/p>\n Sources: Ruby on Rails, “Rails security releases: 8.0.5.2 and 8.1.4.1” (November 4, 2026) \u2014 discuss.rubyonrails.org\/t\/rails-security-releases-8-0-5-2-and-8-1-4-1\/91802<\/a>; The Hacker News, “Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads” (November 4, 2026) \u2014 thehackernews.com\/2026\/11\/critical-rails-flaw-lets-attackers.html<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":" If you run a Rails app that takes uploads, check your version today. This morning, November 4, the Rails team released two security updates \u2014 8.1.4.1 and 8.0.5.2 \u2014 fixing 21 security issues at once. At the top is a critical flaw in Active Storage, the part of Rails that handles uploads, rated 9.8 out […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[],"class_list":["post-176","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/posts\/176","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/comments?post=176"}],"version-history":[{"count":0,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/posts\/176\/revisions"}],"wp:attachment":[{"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/media?parent=176"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/categories?post=176"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/tags?post=176"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}:mini_magick<\/code> processor, the default for apps on load_defaults 6.1 or earlier; its ImageMagick policy does not already block the coders involved \u2014 Rails says the policies Debian and Ubuntu ship do not; and it accepts uploads from untrusted users.<\/p>\nThe calendar problem<\/h2>\n
What to actually do<\/h2>\n
:mini_magick<\/code>, you also need mini_magick 5.1 or later, or the app will raise an error at boot.<\/p>\nbin\/rails runner 'puts MiniMagick.identify { |i| i.list \"policy\" }'<\/code> and confirm the policy is loaded. An app that replaces MiniMagick’s environment after boot, uses GraphicsMagick, or has a permissive rule in the server’s own policy can quietly undo it.<\/p>\n