Vulnerability · critical
Rails ImageMagick upload flaw allows writing server files, fixed in Rails 8.0.5.2 and 8.1.4.1
Tier B · Patch this week – Put it in the sprint
Who’s exposed: Rails apps processing uploads via ImageMagick/mini_magick
Tier B because: Core infrastructure or popular tool AND remote, no login
Reach
Attack
Damage
Fix
Popular tool · Remote, no login
What to do
- Upgrade to Rails 8.0.5.2 or 8.1.4.1
The Brief
- A critical Ruby on Rails flaw lets an unauthenticated attacker write arbitrary files on the server by uploading a crafted file.
- The flaw affects apps that process uploads with ImageMagick, including Active Storage setups using ImageMagick/mini_magick.
- Rails 8.0.5.2 and 8.1.4.1 fix it; the release addresses 21 security issues in total.
Why it matters
Any Rails app that handles image uploads through ImageMagick may let attackers write files to the server without logging in, so the upgrade should be treated as urgent.
The checklist behind the tier
Checklist · 3 of 10 yes
| Yes | Hits tech teams | Judgment: Rails is a web framework that developers build and run apps with. |
| No | Core infrastructure | Judgment: a single framework's flaw, not software nearly every team runs. |
| Yes | Popular tool | Judgment: Rails is a widely used mainstream web framework. |
| No | Exploited in the wild | No source reports observed attacks, KEV listing, or campaigns using this flaw. |
| No | Public exploit | No source says exploit code or a proof-of-concept is published; only an advisory is cited. |
| Yes | Remote, no login | The Hacker News: unauthenticated attacker can write server files by uploading a crafted file. |
| No | Full takeover | The Hacker News: sources describe only arbitrary file writes on the server, not code execution or admin rights. |
| No | Secrets exposed | No source reports stolen credentials, tokens, keys, configs, source code or customer data. |
| No | Supply chain | No source reports a compromised package, update, pipeline, image or signing key. |
| No | No fix yet | Ruby Weekly and Rails blog: fixed in Rails 8.0.5.2 and 8.1.4.1. |
Timeline
Flaw disclosed in Rails advisory and fixed in 8.0.5.2 and 8.1.4.1 (as reported by The Hacker News)
The Hacker News
Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads
Rails 8.0.5.2 and 8.1.4.1 released as a 21-advisory security release (as reported by Ruby Weekly)
Ruby Weekly
Patch Rails now: 21 security fixes in one release
Ruby on Rails: Compress the complexity of modern web apps
This Week in Rails: November 6, 2026
Full coverage · 3 sources
- 18h ago ↗
Ruby on Rails: Compress the complexity of modern web apps
This Week in Rails: November 6, 2026 - 2d ago ↗
- 2d ago ↗
The Hacker News
Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads
First seen · 3 sources · Full story page · How tiers are decided