Ruby on Rails Active Storage Flaw Allows Arbitrary File Writes

# Ruby on Rails Active Storage Flaw Allows Arbitrary File Writes

https://gcdradar.vercel.app/incidents/ruby-on-rails-active-storage-flaw-allows-arbitrary-file-writ · AIR-2026-1766 · live

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): Critical flaw with patches released.
- Fix status: Patched
- First reported: 2026-11-04
- AI role: No AI role
- Products: Ruby on Rails

## Summary

A critical vulnerability in Ruby on Rails Active Storage lets unauthenticated attackers write files to the server using crafted ImageMagick uploads. The project released versions 8.1.4.1 and 8.0.5.2 to address the issue.

## What to do

Update to Ruby on Rails 8.1.4.1 or 8.0.5.2.

## Affected and fixed versions

- Affected: Ruby on Rails versions prior to 8.1.4.1 and 8.0.5.2
- Fixed in: Ruby on Rails 8.1.4.1
- Fixed in: Ruby on Rails 8.0.5.2

## Latest updates

- 2026-11-04: Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads (https://thehackernews.com/2026/11/critical-rails-flaw-lets-attackers.html)

## Sources

- 2026-11-04 The Hacker News: Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads https://thehackernews.com/2026/11/critical-rails-flaw-lets-attackers.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.