---
title: Critical Rails Active Storage flaw: a crafted image upload can make ImageMagick write files, and read any file (including secret_key_base) when attachments use the Disk service | ctxsec
url: https://ctxsec.com/items/rails-active-storage-imagemagick-ghsa-f3w6-file-write-read-9-8
description: "Rails says applications that analyze attachments with ImageMagick may let an unauthenticated attacker write arbitrary files on the server and, with the Disk storage service, read any file the app process can read, which typically includes secret_key_base and credentials for other systems (CVSS 9.8). ImageMagick picks a coder from file content, and some coders act on files named inside the image; Active Storage restricted none of them, and simply attaching an upload triggers analysis. Fixed in activestorage 8.0.5.2 and 8.1.4.1, which ship an ImageMagick security policy. watchTowr told Dark Reading it has reproduced the bug in a lab and expects a public PoC within days."
status: "official (Rails security advisory GHSA-f3w6-w445-fwh9, Nov 4; no exploitation reported)"
published: 2026-11-04
---

> Rails says applications that analyze attachments with ImageMagick may let an unauthenticated attacker write arbitrary files on the server and, with the Disk storage service, read any file the app process can read, which typically includes secret_key_base and credentials for other systems (CVSS 9.8). ImageMagick picks a coder from file content, and some coders act on files named inside the image; Active Storage restricted none of them, and simply attaching an upload triggers analysis. Fixed in activestorage 8.0.5.2 and 8.1.4.1, which ship an ImageMagick security policy. watchTowr told Dark Reading it has reproduced the bug in a lab and expects a public PoC within days.

[← Cybersecurity News](/news) · [markdown](/items/rails-active-storage-imagemagick-ghsa-f3w6-file-write-read-9-8.md)

official (Rails security advisory GHSA-f3w6-w445-fwh9, Nov 4; no exploitation reported)

2026-11-04

### Critical Rails Active Storage flaw: a crafted image upload can make ImageMagick write files, and read any file (including secret_key_base) when attachments use the Disk service

- **You're affected if:** the app uses ImageMagick through mini_magick for Active Storage (the default on `load_defaults 6.1` or earlier), ImageMagick's policy doesn't already deny the coders involved (Debian and Ubuntu's packaged policies don't), and untrusted users can upload files.
- **Fix:** upgrade activestorage to 8.0.5.2 / 8.1.4.1 with mini_magick 5.1 or later (older mini_magick raises an error at boot). Apps that render PDF/PostScript must re-allow the `gs` delegate in the host policy.
- **Can't upgrade yet:** copy the shipped `policy.xml` rules into the system ImageMagick policy; at minimum deny the `MSL` coder, the Ghostscript coders and the `gs` delegate.
- **If attachments use the Disk service:** rotate `secret_key_base`, the master key and everything in `credentials.yml.enc`, storage and database credentials and third-party tokens; don't keep the old secret as a fallback.

Sources: [Rails: Possible arbitrary file write and read in Active Storage image analysis (GHSA-f3w6-w445-fwh9)](https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9) · [Dark Reading: Critical Rails Bug Threatens to Derail Vulnerable Servers (Nov 4)](https://www.darkreading.com/application-security/critical-rails-bug-derail-vulnerable-servers)