A significant vulnerability in Ruby on Rails could enable an unauthenticated attacker to write arbitrary files on an application's server by uploading a crafted file if the application processes uploads using ImageMagick This article explores significant vulnerability ruby. . The issue lies within Active Storage, a component of Rails responsible for managing file uploads.
Accessing them could potentially lead to remote code execution or lateral movement within those systems.
Rails said one attack chain was reported to it, but it does "not assume it is the only one that exists." The advisory does not say whether the flaw has been exploited. If it is not specified, the default choice is determined by load_defaults: :mini_magick before version 7.0, and :vips since version 7.0.
Versions prior to 8.0.5.2 and 8.1 versions prior to 8.1.4.1 are affected.
In July, Rails addressed a distinct critical Active Storage vulnerability, CVE-2026-66066, which impacted apps utilizing libvips instead of ImageMagick. The same update addresses a second Active Storage vulnerability, GHSA-v924-7rp8-4mxh, which Rails classifies as high with a CVSS score of 8.8. The policy blocks MSL coders, those reading or deleting files other than images, fetching remote or local references, displaying them on screens, and any coders relying on Ghostscript or the gs delegate.
It does not reach an app that replaces MiniMagick.cli_env after boot, clears the environment with MiniMagick.cli_prefix, or installs its own MiniMagick::Shell.
