Ruby on Rails Active Storage: critical file write flaw via ImageMagick uploads

What happened

On 4 November 2026 a critical vulnerability in Ruby on Rails Active Storage was made public. An unauthenticated attacker can write arbitrary files on the server by sending a crafted upload, provided the application processes uploads with ImageMagick. Writing arbitrary files on a web server can give an attacker a foothold to change application code or configuration.

The Rails maintainers have released fixed versions: Rails 8.1.4.1 and Rails 8.0.5.2. At the time of writing there are no reports of active exploitation, but because no login is required, applications that accept uploads from the public should be updated promptly.

Who is affected

• Applications built on Ruby on Rails that use Active Storage for file uploads
• and process those uploads (for example, image variants or previews) with ImageMagick
• running a Rails version older than 8.1.4.1 (8.1 series) or 8.0.5.2 (8.0 series)

If you run older Rails release series, the source data does not state whether they are affected or fixed. Check the Rails security announcement and the article linked below for your version.

Agencies should check every customer application that runs on Rails, including internal tools and staging systems that accept uploads.

What to do now

1. List all Rails applications you operate and note the Rails version of each (see the next section).
2. Back up the application code, Gemfile, Gemfile.lock and configuration before changing anything.
3. Update Rails to 8.1.4.1 (if you are on 8.1) or 8.0.5.2 (if you are on 8.0), for example by setting the version in the Gemfile and running bundle update rails. Commit the updated Gemfile.lock.
4. Run your test suite and deploy the update through your usual deployment process.
5. Restart the application server (for example Puma or Passenger) and any background job workers so the new version is loaded.
6. Test an upload with image processing to confirm the application still works.
7. If you cannot update right away, consider temporarily disabling public uploads or image processing in the affected application until the update is in place.

How to check whether you are affected

• Rails version: in the application directory run bundle exec rails -v, or look for the rails entry in Gemfile.lock. Versions below 8.1.4.1 (8.1 series) or 8.0.5.2 (8.0 series) need the update.
• ImageMagick usage: check whether the application uses ImageMagick for Active Storage, for example via the mini_magick gem in Gemfile.lock or a variant_processor setting of :mini_magick in the Rails configuration. Also check whether ImageMagick is installed on the server (convert -version or magick -version).
• Signs of compromise: review web server and application logs for unusual upload requests since 4 November 2026, and look for unexpected or recently modified files in the application directory, the public directory and configuration paths (for example with find /path/to/app -newermt 2026-11-04 -type f). Investigate any files you cannot explain before assuming the system is clean.

Sources

• https://thehackernews.com/2026/11/critical-rails-flaw-lets-attackers.html