Ruby on Rails Active Storage Flaw Lets Attackers Write Files and Leak Server Secrets via Image Uploads

Scope: Ruby on Rails, fixed in versions 8.1.4.1 and 8.0.5.2

Severity: Red

The Rails project disclosed a critical flaw in Active Storage, the framework’s built-in file upload handling, affecting any application that processes uploads using ImageMagick. An unauthenticated attacker can exploit the flaw to write arbitrary files to the application’s server through a crafted upload. For applications that use Active Storage’s Disk service, which stores uploaded files directly on the server’s own disk rather than a remote service, the same flaw also allows the attacker to read any file the application itself can read, and Rails specifically flagged that this typically includes the application’s secret_key_base and credentials used to authenticate with other connected systems, both of which are foundational to an application’s overall security if exposed. Rails stated that one real-world attack chain exploiting this flaw has already been reported to the project, and explicitly noted it does not assume that is the only one that exists. This is the second critical Active Storage flaw Rails has fixed this year; a separate one affecting applications using libvips instead of ImageMagick, CVE-2026-66066, was patched back in July. Adding urgency, Rails 8.0 loses all security support under the project’s maintenance policy on November 7, 2026, just two days away, meaning organisations still on that branch need a version upgrade, not just this one patch. Organisations running Rails applications that process uploads through ImageMagick must update to version 8.1.4.1 or 8.0.5.2 today, and should treat any application using Active Storage’s Disk service as needing particular attention given the secret exposure risk, rotating secret_key_base and any connected system credentials if there is reason to believe the application was exposed.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.