Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads

Rails has patched a critical Active Storage vulnerability, tracked as GHSA-f3w6-w445-fwh9 with a CVSS score of 9.8, that lets an unauthenticated attacker write arbitrary files on an application's server through a maliciously crafted file upload, provided the app relies on ImageMagick for image processing. The problem stems from Active Storage's built-in analyzer, which hands uploaded files to ImageMagick's MSL coder—a scripting engine capable of reading and writing files referenced inside the image—without restricting which coders can be invoked; simply attaching a file triggers the analysis, no variant generation required. Apps that store uploads via Active Storage's Disk service are also exposed to arbitrary file reads, potentially leaking secret_key_base, credentials, and other sensitive tokens, which could enable remote code execution or lateral movement. The same Rails releases, 8.1.4.1 and 8.0.5.2, also fix a second, high-severity Active Storage issue (GHSA-v924-7rp8-4mxh, CVSS 8.8) involving attacker-controlled file extensions tricking ImageMagick and FFmpeg into using the wrong decoder. Rails urges all affected apps to upgrade immediately, verify the new ImageMagick security policy is actually loaded, and rotate any secrets potentially exposed through the Disk service.