thehackernews.com
Nov 4, 2026
Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads
AI-summarised brief · reviewed before publication
A critical vulnerability in Ruby on Rails’ Active Storage allows unauthenticated attackers to write arbitrary files on a server by uploading a crafted file processed with ImageMagick. The flaw, rated 9.8/10 CVSS, enables attackers to read sensitive files such as secret_key_base and credentials, potentially leading to remote code execution or lateral movement. Rails released patches in versions 8.1.4.1 and 8.0.5.2, and the advisory warns that all Active Storage versions before these are affected. The issue was reported by researcher RyotaK via HackerOne.
💡 Why It Matters
- · The flaw exposes core Rails applications to file‑system compromise, turning a simple upload into a full server takeover vector.
- · Prompt patching is essential to prevent attackers from exploiting stored secrets and gaining persistent access.
