Critical Rails Active Storage Flaw Enables File Writes and Secret Theft via Image Uploads

Ruby on Rails has patched a critical Active Storage vulnerability that allows unauthenticated attackers to write arbitrary server files through crafted uploads processed by ImageMagick. Tracked as CVE-2026-122006 and GHSA-f3w6-w445-fwh9, the flaw carries a CVSS score of 9.8 and affects applications processing untrusted attachments through MiniMagick without a sufficiently restrictive ImageMagick security policy. Attaching a file triggers analysis; attackers do not need to request a preview or image variant. Applications using Active Storage’s Disk service may also expose readable server files, including the application’s secret_key_base, potentially enabling remote code execution or lateral movement.

Rails releases 8.0.5.2 and 8.1.4.1 introduce a restrictive ImageMagick security policy and also address a separate decoder-selection vulnerability rated CVSS 8.8. Administrators should upgrade promptly and verify that the new policy is actually enforced, particularly where custom configurations or conflicting system policies require manual changes. Affected Disk-service applications should rotate potentially exposed secrets, review upload logs for suspicious activity, and restrict filesystem permissions. The available reporting does not establish whether exploitation has occurred, and the advisory provides no specific method for detecting prior targeting.