---
title: Tip: find which of your Rails apps are actually exposed to the Active Storage ImageMagick bug before a public exploit lands | ctxsec
url: https://ctxsec.com/items/tip-rails-find-active-storage-apps-using-imagemagick-ghsa-f3w6
description: "Only apps that process uploads with ImageMagick under a permissive policy are affected, and only Disk-service apps need a full secret rotation. A few checks sort your fleet."
status: "official (Rails security advisory GHSA-f3w6-w445-fwh9)"
published: 2026-11-05
---

> Only apps that process uploads with ImageMagick under a permissive policy are affected, and only Disk-service apps need a full secret rotation. A few checks sort your fleet.

[← Tips & Guides](/tips) · [markdown](/items/tip-rails-find-active-storage-apps-using-imagemagick-ghsa-f3w6.md)

official (Rails security advisory GHSA-f3w6-w445-fwh9)

2026-11-05

### Tip: find which of your Rails apps are actually exposed to the Active Storage ImageMagick bug before a public exploit lands

- **Processor:** grep for `variant_processor` in `config/`; if absent, check `config.load_defaults` (6.1 or earlier defaults to `:mini_magick`).
- **Versions:** `bundle exec gem list activestorage mini_magick`; you need activestorage 8.0.5.2 / 8.1.4.1 and mini_magick 5.1+.
- **Policy:** `magick -list policy` (or `convert -list policy`) inside the running container; look for `MSL`, PS/EPS/PDF coders and the `gs` delegate denied.
- **Storage:** grep `config/storage.yml` and `active_storage.service` for `service: Disk`. Those apps need secret rotation after patching.
- Don't forget background workers and image-processing services that share the same image.

Sources: [Rails: Possible arbitrary file write and read in Active Storage image analysis (GHSA-f3w6-w445-fwh9)](https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9)