Critical Ruby on Rails Flaw Could Let Hackers Steal Server Secrets Through Malicious Image Uploads

A critical flaw in Ruby on Rails Active Storage lets an unauthenticated user upload a crafted image and make the server write files. If uploads use the Disk service, the same upload can make the server read files too. The Rails team rated the bug Critical, with a CVSS score of 9.8, and published the advisory on November 4, 2026. The flaw has no CVE ID yet.

The flaw comes from how ImageMagick works. It picks a coder (a file format handler) based on what is inside a file, not on its name. Some coders act on other files named inside the image.

Active Storage did not limit any of these coders, and its image analyzer runs as soon as a file is attached. So an attacker only needs to attach a crafted upload. No variant, preview, or analyze call is needed.

Critical Ruby on Rails Flaw

The files at risk usually include secret_key_base and credentials for outside systems. With those, an attacker may move on to remote code execution or reach other connected services. The Rails team also says one attack chain was reported, but they do not assume it is the only one. The researcher ryotak reported the bug through HackerOne.

An app is affected only if all three of these are true. It uses ImageMagick through config.active_storage.variant_processor = :mini_magick, which is the default for apps on load_defaults 6.1 or earlier.

It runs ImageMagick under a policy that does not already block the coders involved, and the policies packaged by Debian and Ubuntu do not. And it accepts uploads from untrusted users. Affected versions are activestorage before 8.0.5.2, and 8.1 releases before 8.1.4.1.

The fix ships an ImageMagick security policy. Rails adds its folder to MAGICK_CONFIGURE_PATH through MiniMagick.cli_env, so every ImageMagick process that MiniMagick starts follows it.

The policy blocks the MSL scripting coder, coders that read or delete other files, coders that fetch remote or local references, every Ghostscript-backed coder, and @filename indirection. The policy adds to the host’s rules instead of replacing them.

This is not the first image-related Rails scare this year. Cyber Security News recently covered CVE-2026-66066, a Rails Active Storage flaw that affected apps using libvips and could expose secrets such as secret_key_base and cloud keys. Researchers later saw that bug used in real attacks. Teams that patched in the summer should not assume they are safe now, because this is a different processor and a different fix.

ImageMagick has also caused trouble outside Rails. A recent WordPress bug let Author-level users reach code execution because ImageMagick passed a disguised PostScript file to Ghostscript.

A separate Discourse image pipeline exploit chained ImageMagick features to read server files. The lesson is the same each time: image tools do more than open pictures, so untrusted uploads need strict limits.

First, upgrade activestorage to 8.0.5.2 or 8.1.4.1. Apps using :mini_magick also need mini_magick 5.1 or newer, and older versions fail with an error at boot. Apps that render PostScript or PDF through ImageMagick must allow the gs delegate again in the host’s policy.xml.

Apps that replace MiniMagick.cli_env after boot, clear the environment with MiniMagick.cli_prefix, or use their own MiniMagick::Shell do not get the shipped policy. They must copy its rules into ImageMagick’s system policy. GraphicsMagick does not read ImageMagick policies at all.

Teams that cannot upgrade right away can copy the shipped rules into the system policy, for example /etc/ImageMagick-7/policy.xml. At a minimum, they should block the MSL coder, the Ghostscript coders, and the gs delegate.

Secrets need attention too. If attachments live on the Disk service, change secret_key_base and every secret the app process can read. That includes the master key, everything in config/credentials.yml.enc, storage and database credentials, and third-party tokens. The Rails team warns against keeping an exposed secret as a fallback.

This fix is one of 21 security issues in the 8.0.5.2 and 8.1.4.1 releases. Others cover a Strong Parameters bypass, IP spoofing through the Forwarded header in 8.1, several cross-site scripting bugs in Action View, denial-of-service bugs, and session cookie problems.

A second High-rated bug covers file read and code execution through Active Storage video previews and analysis. Security support for the 8.0 series ends on November 7, 2026, so teams on older lines should plan a move to 8.0 or later.

Even with the patch, reviewing upload paths is worth the time. Teams should check logs for odd uploads and make sure no app runs with extra file permissions.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Critical Ruby on Rails Flaw Could Let Hackers Steal Server Secrets Through Malicious Image Uploads appeared first on Cyber Security News.