Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Critical severity, with a CVSS score of 9.8, published 4 November 2026.

Which products and versions are affected?

Ruby on Rails Active Storage before 8.0.5.2, before 8.1.4.1; activestorage (RubyGems) < 8.0.5.2.

Is there a fix for This vulnerability?

Yes: fixed in Rails 8.0.5.2, 8.1.4.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run Ruby on Rails Active Storage or activestorage (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Ruby on Rails Active Storage arbitrary file read/write via ImageMagick

Q: Is there a fix for This vulnerability?

Yes: fixed in Rails 8.0.5.2, 8.1.4.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network.

Q: Am I affected?

Check whether you run Ruby on Rails Active Storage or activestorage (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: critical · CVSS 9.8 · Published 2026-11-04

Ruby on Rails' Active Storage component, which handles file attachments for web applications, fails to restrict ImageMagick's capabilities when processing uploaded images. An attacker can upload a crafted file that causes ImageMagick to read sensitive server files (such as encryption keys) or write arbitrary files to the server, potentially leading to account takeover, data theft, or remote code execution.

Technologies: Ruby on Rails Active Storage, activestorage (RubyGems). Vendors: Ruby on Rails, RubyGems.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Critical severity, with a CVSS score of 9.8, published 4 November 2026.
Which products and versions are affected?: Ruby on Rails Active Storage before 8.0.5.2, before 8.1.4.1; activestorage (RubyGems) < 8.0.5.2.
Is there a fix for This vulnerability?: Yes: fixed in Rails 8.0.5.2, 8.1.4.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run Ruby on Rails Active Storage or activestorage (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Rails 8.0.5.2, 8.1.4.1

Technical details

The vulnerability exists because the ImageMagick analyzer in Active Storage runs automatically when a file is attached, but lacks a security policy to restrict ImageMagick's file operations. An attacker with network access can exploit this via file upload without authentication to read arbitrary files or write files on the server. The flaw stems from insecure default ImageMagick configuration (CWE-1188) that permits unintended file system operations.

Affected products

Ruby on Rails Active Storage before 8.0.5.2, before 8.1.4.1

Timeline

2026-11-04: disclosed
2026-11-04: advisory: GHSA-wgv4-95jc-33jm withdrawn as duplicate of GHSA-f3w6-w445-fwh9

References

https://api.github.com/users/dlagerro

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.