CriticalCVE
Critical Ruby on Rails Flaw Could Let Hackers Steal Server Secrets Through Malicious Image Uploads
Cyber Security News·Source published ·1 min read
What happened?
A critical flaw in Ruby on Rails Active Storage lets an unauthenticated user upload a crafted image and make the server write files. If uploads use the Disk service, the same upload can make the server read files too. The Rails team rated the bug Critical, with a CVSS score of 9.8, and published the advisory on November 4, 2026. The flaw has no CVE ID yet. The flaw comes from how ImageMagick works. It picks a coder (a file format handler) based on what is inside a file, not on its name. Some coders act on other files named inside the image.
Key details
- Affected apps use ImageMagick via :mini_magick and accept uploads from untrusted users.
- Attack can expose secret_key_base and credentials, enabling further exploitation.
- Affected versions: activestorage before 8.0.5.2, and 8.1 releases before 8.1.4.1.
- Upgrade to activestorage 8.0.5.2 or 8.1.4.1 and mini_magick 5.1 or newer.
Affected
- Apps using :mini_magick on load_defaults 6.1 or earlier with untrusted uploads.
- activestorage before 8.0.5.2 and 8.1 releases before 8.1.4.1.
Fixes and mitigations
- Block MSL coder, Ghostscript coders, and gs delegate in system policy.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.