Rails Active Storage has a critical ImageMagick flaw: GHSA-f3w6-w445-fwh9. The Rails security advisory published November 4, 2026 rates it CVSS 9.8. Fixed versions are activestorage 8.0.5.2 and 8.1.4.1; the companion releases are summarized on the Rails blog.
Apps are in scope when they process Active Storage attachments with ImageMagick (MiniMagick), run a policy that does not already deny the involved coders, and accept uploads from untrusted users. A crafted upload can write arbitrary files; with the Disk service it can also read files the app process can read — typically including secrets.
Rails Active Storage: impact without exploit steps
ImageMagick picks a coder from file content; some coders act on referenced files rather than the image itself. Active Storage previously did not constrain those coders, and the analyzer runs on attach — no extra variant or preview call required. The advisory describes one reported chain but does not assume it is the only one. Exploit reproduction does not belong here; operators should patch, not rebuild attacks.
Fixed releases ship an ImageMagick security policy and prepend its directory to MAGICK_CONFIGURE_PATH via MiniMagick.cli_env. The policy denies, among other things, the MSL coder, coders/delegates that read or delete non-image files or fetch remote references, Ghostscript-backed coders, and the gs delegate. Apps with variant_processor = :mini_magick need mini_magick ≥ 5.1.
Affected versions and companion patches
Per the advisory: activestorage < 8.0.5.2 and ≥ 8.1, < 8.1.4.1. Rails 8.0.5.2 and 8.1.4.1 address 21 security themes in total according to the blog — including additional Active Storage, XSS, DoS, and session issues. Security support for the 8.0 series ends November 7, 2026 per the blog; older lines are unsupported.
Workaround without an immediate gem bump: copy the shipped policy rules into ImageMagick’s system policy.xml (at minimum MSL, Ghostscript coders, and gs). Apps that render PostScript/PDF through ImageMagick must deliberately re-allow the needed coders/delegates in the host policy. GraphicsMagick does not read ImageMagick policies.
What operators should do now
Move to patched activestorage and ensure mini_magick ≥ 5.1. If Disk storage and untrusted uploads were in play: rotate secret_key_base, the master key, credentials, storage/database access, and third-party tokens — the advisory warns not to keep an exposed secret as a fallback. Review upload surfaces and variant pipelines for untrusted content.
On code404zero we have covered related web-security stories: CVE-2026-119977 WordPress core, CVE-2026-81648, PHP2Shell, and the PHP emergency patches. The shared pattern: upload and update paths stay high risk when processors and secrets share a host.
Other fixes in the same release train
Besides GHSA-f3w6-w445-fwh9, the November 4 Rails releases also address — per the blog — a high-severity file-read/RCE issue in Active Storage video previews and image processing (GHSA-v924-7rp8-4mxh), a Strong Parameters bypass, remote IP spoofing (8.1 only), multiple Action View XSS issues, DoS vectors, and session/cache themes. Patching only an ImageMagick policy while staying on an old Rails line misses that bundle.
Security support for 8.0 ends November 7, 2026 — days after the advisory. Teams on 8.0 should plan the jump to patched 8.0.5.2 and a path onto a supported series in parallel. Unsupported older majors no longer receive fixes per the blog.
Policy pitfalls in practice
Apps that replace MiniMagick.cli_env after boot, clear the environment with MiniMagick.cli_prefix, or install a custom MiniMagick::Shell do not receive the shipped policy and must carry the rules in the system policy. PDF/PostScript rendering through ImageMagick needs deliberate re-allow of Ghostscript paths; a blanket deny can break production features.
Debian/Ubuntu packaged policies are not sufficient per the advisory. After upgrading, record ImageMagick version, MiniMagick version, Active Storage processor, and storage service (Disk vs cloud) in a runbook. If exposure is suspected: follow an incident playbook with secret rotation and log review — without publishing exploit details.
Bottom line
The flaw is rated critical and has clear fix versions; the advisory does not list a CVE ID at publication time (GHSA only). Credit goes to HackerOne researcher ryotak. For Rails teams, upgrade speed — and secrets rotation when Disk storage was used — matters more than CVSS debates.
Disk storage and secret hygiene
The advisory is explicit: with the Disk service and possible untrusted uploads, rotate secrets — secret_key_base, the credentials master key, everything in credentials.yml.enc, storage/database access, and third-party tokens. Keeping an old secret as a fallback undoes the rotation. Cloud object storage reduces the local file-read path but does not replace patching the ImageMagick chain.
Post-upgrade monitoring should watch failed analyses, unusual writes outside expected upload paths, and ImageMagick policy violations in logs — without publishing PoC reproduction. Advisory credit: HackerOne researcher ryotak.
In short: Rails Active Storage with ImageMagick needs 8.0.5.2 or 8.1.4.1. Primary sources are the GitHub advisory and the Rails release post from November 4, 2026.
