# Rails Active Storage: uploaded images can expose application secrets Canonical: https://www.oktsec.com/radar/rails-active-storage-ghsa-f3w6-w445-fwh9 Publisher: Oktsec Language: en Published: 2026-11-05T12:24:43Z Updated: 2026-11-05T12:24:43Z Record reviewed: 2026-11-05T12:24:43Z Latest evidence check: 2026-11-05T12:24:43Z Disclosed: 2026-11-04 A critical Active Storage flaw can permit file writes and, with Disk storage, reads under application permissions. Exposure requires ImageMagick, a permissive coder policy and untrusted uploads. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Act now - Rationale: Prioritize applications that accept untrusted uploads through the affected ImageMagick configuration. The advisory does not establish active attacks. - Evidence: Attacks not established - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Application or configuration dependent - Vendor: Ruby on Rails - Products: Active Storage, ImageMagick - Vendor severity: CVSS 3.0 9.8 ## Technical overview GHSA-f3w6-w445-fwh9 has no assigned CVE at this review. Arbitrary file access can expose secrets and lead to code execution; it does not mean every Rails application is affected or that attacks have been confirmed. The correction adds an ImageMagick policy to commands launched by MiniMagick. It supplements the host policy and applies beyond Active Storage. Configuration overrides and document processing therefore need explicit verification. Oktsec recommends testing startup and upload processing on the deployed application, then recording the running package versions and policy configuration. Installing a package is only one part of that check. ## Recommended response Upgrade Active Storage to 8.0.5.2 or 8.1.4.1 and verify the ImageMagick policy. Affected Disk deployments must also rotate application secrets. Relevant to: Teams operating Rails applications with Active Storage uploads. ## Affected systems and fixes ### activestorage Affected: < 8.0.5.2; >= 8.1 and < 8.1.4.1. The configuration conditions also apply. Fixed release / action: 8.0.5.2; 8.1.4.1 Confirm the running version against the vendor advisory, including any distribution backports. ## Response checklist 1. **Confirm the upload path** — Check variant_processor = :mini_magick, the effective ImageMagick policy and whether untrusted users can attach files. Attaching a file can invoke analysis without an explicit variant request. 2. **Upgrade and verify startup** — Deploy the corrected Active Storage branch with mini_magick 5.1 or later. Older mini_magick causes affected applications to fail at boot. 3. **Verify that the policy reaches ImageMagick** — Custom MiniMagick.cli_env, cli_prefix or Shell implementations can bypass the bundled policy. Check the system policy in these deployments; GraphicsMagick does not read ImageMagick policies. 4. **Rotate secrets for affected Disk deployments** — Replace secret_key_base, the master key, encrypted credential contents and other secrets readable by the application. Do not retain exposed keys as fallbacks. 5. **Test document processing** — The fix restricts coders and Ghostscript. Test PDF and PostScript workflows; review any exception against the official release guidance before enabling it. ## Relevance to AI environments Oktsec recommends including credentials for connected automation services in the recovery inventory. ## Sources - [GHSA-f3w6-w445-fwh9: scope and credential recovery](https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9) — Ruby on Rails; Vendor notice; checked 2026-11-05T12:14:16Z - [Rails 8.1.4.1: ImageMagick policy and compatibility changes](https://github.com/rails/rails/releases/tag/v8.1.4.1) — Ruby on Rails; Vendor notice; checked 2026-11-05T12:14:16Z - [Rails 8.0.5.2: corrected branch release](https://github.com/rails/rails/releases/tag/v8.0.5.2) — Ruby on Rails; Vendor notice; checked 2026-11-05T12:14:16Z ## Editorial record - 2026-11-05T12:24:43Z: Added scope, evidence and response guidance from the official notices. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/rails-active-storage-ghsa-f3w6-w445-fwh9) · [Build a response plan](https://www.oktsec.com/radar/rails-active-storage-ghsa-f3w6-w445-fwh9#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=rails-active-storage-ghsa-f3w6-w445-fwh9&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=rails-active-storage-ghsa-f3w6-w445-fwh9&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.