{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/active-storage--8.0.5.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Ruby on Rails","Ruby on Rails (\u003c 8.0.5.2)","Ruby on Rails (8.x \u003c 8.1.4.1)","Active Storage (\u003c 8.0.5.2)","Active Storage (\u003c 8.1.4.1)","Active Storage (\u003e= 8.1, \u003c 8.1.4.1)"],"_cs_severities":["critical"],"_cs_tags":["rails","vulnerability","web-framework","application-security","imagemagick","file-upload","critical-vulnerability"],"_cs_type":"advisory","_cs_vendors":["Ruby on Rails"],"content_html":"\u003cp\u003eA critical vulnerability (GHSA-f3w6-w445-fwh9) exists in the Ruby on Rails Active Storage component when configured to use ImageMagick for image processing. The flaw stems from ImageMagick selecting image decoders based on file content rather than file extensions. Unauthenticated attackers can exploit this by uploading crafted image files, enabling arbitrary file writes to the server and arbitrary file reads of any files accessible to the application process. Successful exploitation may lead to the exposure of sensitive secrets, such as \u003ccode\u003esecret_key_base\u003c/code\u003e, database credentials, and third-party tokens, facilitating lateral movement or remote code execution.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eImpact includes unauthorized read/write access to the server filesystem, theft of application secrets, and potential full system compromise. If attachments are stored with the Disk service, secrets such as \u003ccode\u003econfig/credentials.yml.enc\u003c/code\u003e and external system credentials are at high risk of exfiltration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Rails Active Storage to version 8.0.5.2, 8.1.4.1, or later.\u003c/li\u003e\n\u003cli\u003eIf using the Disk service, rotate all application secrets immediately, including the master key, storage credentials, database passwords, and third-party API tokens, as they must be assumed compromised if previously stored.\u003c/li\u003e\n\u003cli\u003eApply the recommended ImageMagick system policy rules provided in the GitHub advisory to restrict dangerous coders.\u003c/li\u003e\n\u003cli\u003eInventory all Rails applications using Active Storage with ImageMagick to identify exposure.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T22:57:23Z","date_published":"2026-11-04T16:19:52Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ruby-on-rails-multiple-vulnerabilities/","summary":"A critical vulnerability in the Rails Active Storage component allows unauthenticated attackers to perform arbitrary file reads and writes by uploading crafted image files that exploit the ImageMagick processing suite.","title":"Ruby on Rails: Arbitrary File Read and Write via Active Storage and ImageMagick (GHSA-f3w6-w445-fwh9)","url":"https://feed.craftedsignal.io/briefs/2026-11-ruby-on-rails-multiple-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - Active Storage (\u003c 8.0.5.2)","version":"https://jsonfeed.org/version/1.1"}