Rails Active Storage ImageMagick Flaw: Upgrade to 8.1.4.1 or 8.0.5.2, Then Rotate Secrets

Rails fixed a critical Active Storage flaw on 4 November 2026. If your app processes attachments with ImageMagick, an unauthenticated attacker may be able to write files on your server just by uploading a crafted file. Upgrade to activestorage 8.1.4.1 or 8.0.5.2 now.

The Rails advisory GHSA-f3w6-w445-fwh9 is rated Critical, CVSS 3.0 9.8. It lists no CVE id and no CVSS 4.0 score. CERT-FR covers the release in CERTFR-2026-AVI-1452, which lists remote code execution among the risks.

Which Apps Are Affected and Which Versions Fix It?

An app is affected if it meets all three conditions in the advisory. It uses ImageMagick for Active Storage image processing (variant_processor = :mini_magick, the default for load_defaults 6.1 or earlier). It runs ImageMagick under a policy that does not already deny the coders involved, which includes the policies Debian and Ubuntu package. And it accepts uploads from untrusted users.

The Rails announcement says older versions are unsupported and recommends moving to at least the 8.0 series. It adds that security support for 8.0 ends on 7 November 2026.

How Does an Upload Become a File Write?

ImageMagick picks a coder from the content of the file, and some coders act on files named inside the image. Active Storage constrained none of them, and the ImageMagick analyzer runs when a file is attached. An attacker who can upload a crafted file may therefore invoke one, and attaching it is enough.

The fix commit gives an example: an uploaded SVG reached the MSL scripting coder, which reads and writes the files its script names. The advisory says one attack chain was reported and the Rails team does not assume it is the only one. With the Disk service, the attacker may also read files the app process can read, such as secret_key_base and credentials for other systems.

What Should You Do Now?

1. Find affected apps. Run bundle list | grep -E "activestorage|mini_magick" and search config/ for variant_processor.
2. Upgrade Rails to 8.1.4.1 or 8.0.5.2. An app on :mini_magick also needs mini_magick 5.1 or later, or it raises at boot.
3. Check the policy loads: bin/rails runner 'puts MiniMagick.identify { |i| i.list "policy" }', the command from the Rails guide.
4. Handle the exceptions. Apps that render PostScript or PDF through ImageMagick must re-allow the gs delegate in the host policy. Apps that replace MiniMagick.cli_env, clear the environment with MiniMagick.cli_prefix, install their own MiniMagick::Shell or use GraphicsMagick must copy the rules into ImageMagick’s system policy.
5. If you cannot upgrade today, copy the rules of the shipped policy.xml into the system policy, for example /etc/ImageMagick-7/policy.xml. At a minimum deny the MSL coder, the Ghostscript coders and the gs delegate.
6. Rotate secrets if the app uses the Disk service and takes untrusted uploads. Change secret_key_base, the master key, everything in config/credentials.yml.enc and the tokens the app holds. Changing secret_key_base signs users out and invalidates signed cookies and Active Storage URLs.
7. Review recent uploads and the app’s file system. Look for blobs with SVG, MSL, PostScript or PDF content from untrusted users, and for files in application directories that changed since the upload.

Steps 1, 3 and 7 and the review scope are our advice, and the rest follows the Rails advisory. For related reading, see our Exploit Public-Facing Application technique page, the credentials in files technique and the patch management entry.

What Do Rails and CISA KEV Say About Exploitation, and What Else Shipped?

The flaw is not in the CISA Known Exploited Vulnerabilities catalog as of its 4 November 2026 release, and the advisory carries no CVE id yet. A HackerOne researcher reported the flaw to Rails.

The same release fixes 21 issues. GHSA-v924-7rp8-4mxh (High, CVSS 3.1 8.8) covers uploads whose file extension steers FFmpeg or ImageMagick to a decoder, and its AviSynth path needs an FFmpeg built with that support. For earlier ImageMagick coverage, see CISA’s ImageMagick exploitation warning.