Security · High impactFan score 44 · Tier B3 sources

This Week in Rails: November 6, 2026

The Brief

A critical Ruby on Rails flaw lets an unauthenticated attacker write arbitrary files on the server by uploading a crafted file.
The flaw affects apps that process uploads with ImageMagick, including Active Storage setups using ImageMagick/mini_magick.
Rails 8.0.5.2 and 8.1.4.1 fix it; the release addresses 21 security issues in total.

Why it matters

Any Rails app that handles image uploads through ImageMagick may let attackers write files to the server without logging in, so the upgrade should be treated as urgent.

Who’s affected

Rails apps using Active Storage with ImageMagick
Rails 8.0 and 8.1 teams processing user uploads

What to do

Upgrade to Rails 8.0.5.2 or 8.1.4.1

Rails 8.0.5.2
Rails 8.1.4.1
#rails
#security
#imagemagick
#file-upload
#active-storage

Hi, it’s Greg , bringing you the latest changes in the Rails codebase. It was a busy week, with a lot of changes, so buckle up! Rails 8.0.5.2 and 8.1.4.1 have been released! These are security releases, addressing 21 security issues, so you should upgrade if you haven’t already…

Read the full story at rubyonrails.org ↗