A crafted image upload lets attackers write files to Ruby on Rails servers

Ruby on Rails, the web framework behind many online stores, SaaS products and startups, has fixed a critical flaw that lets an attacker with no account write arbitrary files to the server just by uploading a crafted image. The bug sits in Active Storage, the Rails component that handles file uploads, and affects apps that process images with ImageMagick. It is rated 9.8 out of 10, according to the Rails security advisory. The fix shipped on 4 November in Rails 8.0.5.2 and 8.1.4.1.

ImageMagick decides how to read a file from its contents, not from its name. Some of its "coders" do not just decode a picture: they follow instructions inside the file and read or write other files on the disk. Active Storage did not restrict any of them and runs its ImageMagick analyzer the moment a file is attached. "Attaching the upload is sufficient; no variant, preview, or analyze call is required," the advisory says.

If an app keeps uploads on the local disk (the Disk service), the attacker can also read any file the app can read. That usually includes secret_key_base and credentials for databases, cloud storage and third-party services. With those, the advisory warns, an attacker may get to remote code execution or move on to the connected systems. The flaw was reported by the HackerOne researcher ryotak. Rails says one attack chain was reported, "but we do not assume it is the only one that exists".

Read the full article on vpnlab.io: https://vpnlab.io/en/ruby-on-rails-active-storage-imagemagick-flaw-2026-3225