CVSS 9.8: How a Crafted Image Upload Can Let Attackers Own Your Rails Server
In November 2026, the Ruby on Rails project disclosed a critical vulnerability (GHSA-f3w6-w445-fwh9, CVSS 9.8) in Active Storage, its file-upload subsystem. An unauthenticated attacker can upload a crafted file that exploits ImageMagick's MSL coder to write arbitrary files anywhere on the server's filesystem. Because Active Storage imposes no restrictions on which ImageMagick coders a file may invoke, and because the MSL coder can read and write named files via its scripting interface, exploitation requires only that a file be attached—no variant generation or explicit analysis call is needed. Apps storing uploads on disk are also exposed to arbitrary file reads, enabling credential theft (secret_key_base, database passwords, third-party tokens) and subsequent remote code execution or lateral movement. Rails fixed the flaw in versions 8.1.4.1 and 8.0.5.2, shipping a restrictive ImageMagick security policy alongside the patch. This disclosure follows a separate critical Active Storage flaw (CVE-2026-66066) patched in July 2026 targeting libvips users, signaling a sustained attacker focus on Rails file-processing pipelines. The pattern reflects a broader industry trend of chaining file-upload primitives with image-processing libraries to achieve server-side code execution—a technique with growing prevalence across web frameworks and SaaS platforms.
Kill Chain
