Security · High impactFan score 44 · Tier B3 sources

Patch Rails now: 21 security fixes in one release

The Brief

A critical Ruby on Rails flaw lets an unauthenticated attacker write arbitrary files on the server by uploading a crafted file.
The flaw affects apps that process uploads with ImageMagick, including Active Storage setups using ImageMagick/mini_magick.
Rails 8.0.5.2 and 8.1.4.1 fix it; the release addresses 21 security issues in total.

Why it matters

Any Rails app that handles image uploads through ImageMagick may let attackers write files to the server without logging in, so the upgrade should be treated as urgent.

Who’s affected

Rails apps using Active Storage with ImageMagick
Rails 8.0 and 8.1 teams processing user uploads

What to do

Upgrade to Rails 8.0.5.2 or 8.1.4.1

Rails 8.0.5.2
Rails 8.1.4.1
#rails
#security
#imagemagick
#file-upload
#active-storage

#825 — November 5, 2026 Read on the Web Ruby Weekly 🔒 Rails 8.0.5.2 and 8.1.4.1 Released to Fix 21 Security Issues — A rare 21-advisory release, led by a critical Active Storage bug (when using ImageMagick/ mini_magick ) where attaching a specially crafted image can let an…

Read the full story at rubyweekly.com ↗