Ethical Hacking News
A critical flaw in the Ruby on Rails framework allows unauthenticated attackers to write arbitrary files on an app's server by uploading a crafted file if the app processes uploads using ImageMagick. This vulnerability poses a significant threat to web applications that use ImageMagick for Active Storage image processing. Rails recommends upgrading as soon as possible to fix this vulnerability.
A critical flaw in Ruby on Rails' ImageMagick vulnerability allows unauthenticated attackers to write arbitrary files on a server by uploading a crafted file. The vulnerability, rated 9.8 out of 10 on the CVSS scale, poses a significant threat to web applications that use ImageMagick for Active Storage image processing. Every Active Storage version before 8.0.5.2 is affected, as well as 8.1 versions before 8.1.4.1. Apps that use GraphicsMagick get no protection from the shipped policy, and users must manually update their ImageMagick policy. Users are strongly recommended to upgrade to Rails 8.1.4.1 or 8.0.5.2 as soon as possible to mitigate the vulnerability.
A critical flaw in the Ruby on Rails framework has been discovered, allowing unauthenticated attackers to write arbitrary files on an app's server by uploading a crafted file if the app processes uploads using ImageMagick. This vulnerability, rated 9.8 out of 10 on the CVSS scale, poses a significant threat to web applications that use ImageMagick for Active Storage image processing. The vulnerability was reported through HackerOne by RyotaK, a researcher at GMO Flatt Security, and has been fixed in versions 8.1.4.1 and 8.0.5.2 of the Rails framework.
The vulnerability is rooted in Active Storage, the part of Rails that handles file uploads. Some apps store uploaded files using Active Storage's Disk service, which stores them on the server's disk. In those apps, an attacker could also read any file the app can read, including sensitive information such as the app's secret_key_base and credentials for other systems. This could potentially lead to remote code execution or lateral movement into those systems.
ImageMagick selects a format handler, which it calls a coder, based on the file's content. Some coders act on other files named inside the image, not on the image itself. Active Storage imposes no limits on which coders an upload can use, so the server's own ImageMagick policy was the only limit. The ImageMagick analyzer in Active Storage runs when a file is attached, and attaching the upload is enough to reach the flaw. The app does not have to make a variant or a preview, or call analyze.
An uploaded SVG file reached ImageMagick's MSL coder through the analyzer, according to the commit that fixed the flaw. MSL is a scripting coder that reads and writes files named by its script. One attack chain was reported to the Rails project, but it does not assume that it is the only one that exists. The advisory does not say whether the flaw has been exploited.
To determine if an app is affected by this vulnerability, it needs to meet three conditions: it uses ImageMagick for Active Storage image processing, it accepts file uploads from untrusted users, and its ImageMagick security policy does not already block the coders involved. The first condition can be checked by looking at the config.active_storage.variant_processor setting. If it is not set, the default depends on load_defaults 6.1 or earlier, and the default is set to :mini_magick before 7.0, and :vips from 7.0 on.
Every Active Storage version before 8.0.5.2 is affected, as are 8.1 versions before 8.1.4.1. Release series older than 8.0 are no longer supported, and Rails will not release fixed versions for them. The same releases fix a second Active Storage flaw, which Rails rates high with a CVSS score of 8.8. Active Storage passed uploads to ImageMagick and FFmpeg under temporary file names that kept the uploaded file's extension.
To mitigate this vulnerability, Rails strongly recommends upgrading as soon as possible. The two releases fix 21 security issues in total. The fixed versions ship an ImageMagick security policy. MiniMagick is the Ruby gem Active Storage uses to call ImageMagick. In its default setup, every ImageMagick command it runs applies the policy, not only commands from Active Storage. The policy blocks the MSL coder, coders that read or delete files other than the image, coders that fetch remote or local references or display them on a screen, every coder backed by Ghostscript, along with the gs delegate, and @filename indirection.
Upgrade to Rails 8.1.4.1 or 8.0.5.2. Apps on :mini_magick also need mini_magick 5.1 or later, or they raise an error at boot. Rails 8.0 gets security fixes only until November 7, 2026, under its maintenance policy. Confirm that the app loads the new policy, as the Active Storage guide describes, by running bin/rails runner 'puts MiniMagick.identify { |i| i.list "policy" }'. Check whether the shipped policy reaches the app at all. It does not reach an app that replaces MiniMagick.cli_env after boot, clears the environment with MiniMagick.cli_prefix, or installs its own MiniMagick::Shell.
Apps that use GraphicsMagick get no protection from the shipped policy, because GraphicsMagick does not read ImageMagick policies. Check the server's own ImageMagick policy. The shipped policy adds to it rather than replacing it. A rule there that allows a coder, including a wildcard such as pattern="*", overrides the shipped policy's block on that coder.
If the app renders PDF or PostScript files through ImageMagick, re-allow the gs delegate and the coders it uses in the server's policy.xml. If you cannot upgrade yet, copy the rules of the shipped policy, activestorage/lib/active_storage/image_magick/policy.xml, into ImageMagick's system policy, such as /etc/ImageMagick-7/policy.xml. At a minimum, block the MSL coder, the Ghostscript coders, and the gs delegate. Rails also published the fix as patches for 8.1 and 8.0.
Related Information:
https://www.ethicalhackingnews.com/articles/Critical-Flaw-in-Ruby-on-Rails-Allows-Attackers-to-Write-Server-Files-via-Crafted-ImageMagick-Uploads-ehn.shtml
https://thehackernews.com/2026/11/critical-rails-flaw-lets-attackers.html
Published: Wed Nov 4 07:02:34 2026 by llama3.2 3B Q4_K_M
