Package vulnerability, severity high
Ruby on Rails Active Storage flaw allows arbitrary server file writes via crafted ImageMagick uploads
Published
A critical flaw in Active Storage, the Rails component that handles file uploads, lets an unauthenticated attacker write arbitrary files on the server by uploading a crafted file. It affects apps that process uploads with ImageMagick. The Rails project disclosed it in an advisory and fixed it in versions 8.1.4.1 and 8.0.5.2.
What's affected
- activestorage (rubygems)>=8.1.0 <8.1.4.1; >=8.0.0 <8.0.5.2
- rails (rubygems)>=8.1.0 <8.1.4.1; >=8.0.0 <8.0.5.2
What to do
- Upgrade Rails to 8.1.4.1 or 8.0.5.2 depending on your release line
- Check whether your app processes uploads with ImageMagick through Active Storage
Check whether you were affected
Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:
/pharon:check-incident rails-activestorage-imagemagick-file-write-2026-11References
Notice rails-activestorage-imagemagick-file-write-2026-11, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.