Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads
A newly disclosed flaw can hand an attacker the ability to run their own code on systems running Rails -- not a minor bug, the kind that gets full control.
A critical flaw in Ruby on Rails could allow an unauthenticated attacker to write arbitrary files on an app's server by uploading a crafted file if the app processes uploads using ImageMagick .
The flaw is in Active Storage, the part of Rails that handles file uploads.
The Rails project disclosed the flaw in an advisory and fixed it in versions 8.1.4.1 and 8.0.5.2; in July, Rails fixed a different critical Active Storage flaw , CVE-2026-66066, which affected apps that use libvips instead of ImageMagick.
Those files typically include the app's secret_key_base and its credentials for other systems, according to Rails, and some apps store uploaded files using Active Storage's Disk service, which stores them on the server's disk.
Apps using ImageMagick were not exposed to that flaw's attack path, but they can be exposed to this one; active Storage imposes no limits on which coders an upload can use, so the server's own ImageMagick policy was the only limit.
An uploaded SVG file reached ImageMagick's MSL coder through that analyzer, according to the commit that fixed the flaw .
Rails said one attack chain was reported to it, but it does "not assume it is the only one that exists." The advisory does not say whether the flaw has been exploited.
Active Storage passed uploads to ImageMagick and FFmpeg under temporary file names that kept the uploaded file's extension.
The same releases fix a second Active Storage flaw, GHSA-v924-7rp8-4mxh , which Rails rates high with a CVSS score of 8.8; release series older than 8.0 are no longer supported, and Rails will not release fixed versions for them.
Rails strongly recommends upgrading as soon as possible.
What happened
A critical flaw in Ruby on Rails could allow an unauthenticated attacker to write arbitrary files on an app's server by uploading a crafted file if the app processes uploads using ImageMagick.
The vulnerability resides in Active Storage, the component of Rails responsible for handling file uploads.
What changed
The Rails project disclosed the vulnerability in an advisory and addressed it in versions 8.1.4.1 and 8.0.5.2.
In July, Rails resolved a different critical Active Storage flaw, CVE-2026-66066, which impacted applications using libvips instead of ImageMagick.
Who is affected
According to Rails, these uploaded files often include the app's secret_key_base and credentials for other systems.
Some applications utilize Active Storage's Disk service to store uploaded files directly on the server's disk.
Why it matters
While applications using ImageMagick were not vulnerable to the previous flaw's attack vector, they are susceptible to this one.
Active Storage imposes no restrictions on which coders can be used for an upload, meaning the server's own ImageMagick policy is the only safeguard.
Technical details
An uploaded SVG file was able to reach ImageMagick's MSL coder through that analyzer, as noted in the commit that resolved the issue.
Rails indicated that one attack chain was reported to them but does not assume it is the only one that exists; the advisory does not clarify whether the flaw has been exploited.
Active Storage forwarded uploads to ImageMagick and FFmpeg under temporary file names that preserved the uploaded file's extension.
Response
The same releases also address a second Active Storage flaw, GHSA-v924-7rp8-4mxh, which Rails rates as high with a CVSS score of 8.8.
Release series older than 8.0 are no longer supported, and Rails will not issue fixed versions for them.
What security teams should do
Rails strongly recommends upgrading as soon as possible.
The policy blocks the MSL coder, restricts coders that read or delete files other than images, coders that fetch remote or local references or display them, every coder backed by Ghostscript, along with the gs delegate, and @filename indirection.
Attribution
The Hacker News: A critical flaw in Ruby on Rails could allow an unauthenticated attacker to write arbitrary files on an app's server by uploading a crafted file if the app processes uploads using ImageMagick .
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.