MicrosoftAnalysisGitHub Advisories reports critical arbitrary file read and write flaw in Ruby on Rails Active Storage
What happened.The Ruby on Rails team and GitHub Advisory Database published a critical advisory detailing an arbitrary file read and write vulnerability in Active Storage.
Why it matters.Application storage pipelines accept untrusted file uploads across profile forms and media hubs. When image processing engines permit unconstrained coder execution during attachment analysis, threat actors bypass perimeter access controls without credentials. Engineering teams maintaining Rails applications must upgrade to version 8.0.5.2 or 8.1.4.1 immediately. Teams running Disk storage services should rotate application secrets to prevent session forgery attacks.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-122006, the flaw affects the image analyzer when processing attachments with ImageMagick without strict coder execution policies.
- Exploitation risk: Unauthenticated remote attackers uploading crafted image payloads can trigger unintended ImageMagick coders to write arbitrary files onto the server.
- Credential exposure: On deployments using the Disk storage service, attackers can leverage the defect to extract environment files and secret keys.
- Remediation release: The Rails team published security backports in versions 8.0.5.2 and 8.1.4.1, advising administrators to rotate exposed secrets immediately.