Active Storage (< 8.0.5.2, < 8.1.4.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/active-storage--8.0.5.2--8.1.4.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 16:19:52 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRuby on Rails: Arbitrary File Read and Write via Active Storage and ImageMagick (GHSA-f3w6-w445-fwh9)https://feed.craftedsignal.io/briefs/2026-11-ruby-on-rails-multiple-vulnerabilities/Wed, 04 Nov 2026 16:19:52 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-ruby-on-rails-multiple-vulnerabilities/A critical vulnerability in the Rails Active Storage component allows unauthenticated attackers to perform arbitrary file reads and writes by uploading crafted image files that exploit the ImageMagick processing suite.A critical vulnerability (GHSA-f3w6-w445-fwh9) exists in the Ruby on Rails Active Storage component when configured to use ImageMagick for image processing. The flaw stems from ImageMagick selecting image decoders based on file content rather than file extensions. Unauthenticated attackers can exploit this by uploading crafted image files, enabling arbitrary file writes to the server and arbitrary file reads of any files accessible to the application process. Successful exploitation may lead to the exposure of sensitive secrets, such as secret_key_base, database credentials, and third-party tokens, facilitating lateral movement or remote code execution.

Impact

Impact includes unauthorized read/write access to the server filesystem, theft of application secrets, and potential full system compromise. If attachments are stored with the Disk service, secrets such as config/credentials.yml.enc and external system credentials are at high risk of exfiltration.

Recommendation

  • Upgrade Rails Active Storage to version 8.0.5.2, 8.1.4.1, or later.
  • If using the Disk service, rotate all application secrets immediately, including the master key, storage credentials, database passwords, and third-party API tokens, as they must be assumed compromised if previously stored.
  • Apply the recommended ImageMagick system policy rules provided in the GitHub advisory to restrict dangerous coders.
  • Inventory all Rails applications using Active Storage with ImageMagick to identify exposure.
]]>criticaladvisoryrailsvulnerabilityweb-frameworkapplication-securityimagemagickfile-uploadcritical-vulnerability