International
The Morning Dev

Only the news worth knowing

‹
 
A66/100

Vulnerability · critical · CVSS 9.8

Rails ImageMagick image analysis flaw allows arbitrary file write, fixed in Rails 8.0.5.2 and 8.1.4.1

Tier A · Patch today – Before you go home

Who’s exposed: Rails apps processing uploads via ImageMagick/mini_magick

Tier A because: Core infrastructure or popular tool AND remote, no login AND full takeover

Reach

Attack

Damage

Fix

Popular tool · Remote, no login · Full takeover

What to do

  1. Upgrade to Rails 8.0.5.2 or Rails 8.1.4.1

The Brief

  • A critical Active Storage flaw in Ruby on Rails lets an unauthenticated attacker write arbitrary files to a server via a crafted upload when the app processes uploads with ImageMagick.
  • The flaw is fixed in Rails 8.0.5.2 and 8.1.4.1.
  • These releases address 21 security issues in total.

Why it matters

Apps that process uploads with ImageMagick through Active Storage can have files written to their servers by unauthenticated attackers. Upgrading to a patched release closes the flaw.

The checklist behind the tier

Checklist · 4 of 10 yes
YesHits tech teamsJudgment: Rails is a web framework that developers build and run applications with.
NoCore infrastructureJudgment: a single web framework, not software nearly every team runs such as OpenSSH or the Linux kernel.
YesPopular toolJudgment: Rails is a widely used mainstream web framework.
NoExploited in the wildNo source reports observed attacks using this flaw; sources only describe the advisory and fix.
NoPublic exploitNo source says exploit code or a proof-of-concept is published; only an advisory exists.
YesRemote, no loginCVSSCVE-2026-122006: CVSS 9.8 – network, no privileges, no user interaction
YesFull takeoverCVSSCVE-2026-122006: CVSS rates confidentiality and integrity impact high
NoSecrets exposedNo source reports stolen credentials, tokens, configs, source code or customer data.
NoSupply chainThe flaw is a vulnerability in Active Storage upload handling; no source reports malicious code shipped through a trusted channel.
NoNo fix yetGitHub AdvisoryGitHub Advisory: activestorage fixed in 8.1.4.1

The official record

From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.

  • CVE-2026-122006 ↗CVSS 9.8 critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

    The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick securit

    Exploited
    Not in CISA’s exploited catalog
    EPSS
    <1% chance of exploitation in the next 30 days · higher than 55% of all CVEs
    Fix
    • activestorage (rubygems) fixed in 8.1.4.1
    • activestorage (rubygems) fixed in 8.0.5.2
    Weakness
    CWE-1188

    NVDGHSA-f3w6-w445-fwh9

Timeline

  1. Critical flaw disclosed in Rails advisory and reported by The Hacker News

  2. The Hacker News

    Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads

  3. Rails 8.0.5.2 and 8.1.4.1 security releases published, fixing 21 issues

  4. Ruby Weekly

    Patch Rails now: 21 security fixes in one release

  5. Ruby on Rails: Compress the complexity of modern web apps

    This Week in Rails: November 6, 2026

  6. Socket

    Free Certified Patch for Critical Rails Active Storage Vulnerability

  7. GitHub Advisory Database

    Active Storage: Possible arbitrary file write and read in image analysis (CVE-2026-122006)

Full coverage · 5 sources

First seen · 5 sources · Full story page · How tiers are decided