# Ruby on Rails Active Storage arbitrary file read/write via ImageMagick

Source: https://junglewise.ai/threats/duplicate-advisory-active-storage-possible-arbitrary-file-write-and-575968b6  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-13  
License: CC BY 4.0 with a link back

Severity: critical · CVSS 9.8 · Published 2026-11-04

Ruby on Rails' Active Storage component, which handles file attachments for web applications, fails to restrict ImageMagick's capabilities when processing uploaded images. An attacker can upload a crafted file that causes ImageMagick to read sensitive server files (such as encryption keys) or write arbitrary files to the server, potentially leading to account takeover, data theft, or remote code execution.

Technologies: [Ruby on Rails Active Storage](https://junglewise.ai/threats/technologies/active-storage), [activestorage (RubyGems)](https://junglewise.ai/threats/technologies/activestorage). Vendors: [Ruby on Rails](https://junglewise.ai/threats/vendors/ruby-on-rails), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Critical severity, with a CVSS score of 9.8, published 4 November 2026.

**Which products and versions are affected?** Ruby on Rails Active Storage before 8.0.5.2, before 8.1.4.1; activestorage (RubyGems) < 8.0.5.2.

**Is there a fix for This vulnerability?** Yes: fixed in Rails 8.0.5.2, 8.1.4.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run Ruby on Rails Active Storage or activestorage (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Rails 8.0.5.2, 8.1.4.1

## Technical details

The vulnerability exists because the ImageMagick analyzer in Active Storage runs automatically when a file is attached, but lacks a security policy to restrict ImageMagick's file operations. An attacker with network access can exploit this via file upload without authentication to read arbitrary files or write files on the server. The flaw stems from insecure default ImageMagick configuration (CWE-1188) that permits unintended file system operations.

## Affected products

- Ruby on Rails Active Storage before 8.0.5.2, before 8.1.4.1

## Timeline

- 2026-11-04: disclosed
- 2026-11-04: advisory: GHSA-wgv4-95jc-33jm withdrawn as duplicate of GHSA-f3w6-w445-fwh9

## References

- [https://api.github.com/users/dlagerro](https://api.github.com/users/dlagerro)

## Related threats

- [Active Storage: Possible local file disclosure in video previews and analysis](https://junglewise.ai/threats/cve-2026-126188-active-storage-makes-it-simple-to-upload-and-reference-files-in)
- [Ruby on Rails Active Storage arbitrary file read and RCE in media processing](https://junglewise.ai/threats/cve-2026-126186-active-storage-possible-arbitrary-file-read-and-remote-code)
- [Ruby on Rails Active Storage content length bypass in Google Cloud Storage uploads](https://junglewise.ai/threats/cve-2026-126085-active-storage-possible-circumvention-of-file-size-limits-in)
- [Ruby on Rails Active Storage GCS signature bypass](https://junglewise.ai/threats/cve-2026-126084-active-storage-makes-it-simple-to-upload-and-reference-files-in)
- [Rails Active Storage persistent DoS via NUL byte filename](https://junglewise.ai/threats/cve-2026-126074-active-storage-makes-it-simple-to-upload-and-reference-files-in)