Rails 8.0.5.2 and 8.1.4.1 Fix 21 Security Flaws, Including Critical Active Storage File Write Bug
Do Son 
TL;DR
The Ruby on Rails team released versions 8.0.5.2 and 8.1.4.1 on November 4, 2026, fixing 21 security issues. This Rails security update covers file read, file write and possible remote code execution in Active Storage. It also fixes a Strong Parameters bypass, IP spoofing, several XSS bugs and multiple denial-of-service flaws.
The worst bug is rated critical at CVSS 9.8. It lets an unauthenticated attacker write files on a Rails server through a crafted image upload. Four more flaws are rated high. The Rails team says, “We strongly recommend upgrading as soon as possible.”
Why It Matters
Active Storage handles file uploads in a large share of Rails apps. Because the ImageMagick analyzer runs as soon as a file is attached, simply uploading a crafted file may be enough. The advisory notes that “no variant, preview, or analyze call is required.”
The stakes are high. Exposed files “typically include secret_key_base and credentials for external systems.” According to Rails, those secrets “may in turn allow escalation to remote code execution or lateral movement to those systems.”
There is also a deadline. Security support for the Rails 8.0 series ends on November 7, 2026, just three days after this release. Older versions are already unsupported.
So far, the advisories do not report any exploitation in the wild or public proof-of-concept code for the critical bugs. Notably, this follows July’s Active Storage flaw, CVE-2026-66066, for which researchers released PoC code early.
By the numbers
- Critical: 1
- High: 4
- Medium: 13
- Low: 3
How the Attacks Work
Active Storage image analysis (GHSA-f3w6-w445-fwh9, CVSS 9.8)
ImageMagick picks a “coder” based on a file’s content. However, “some coders act on files named inside the image rather than on the image itself.” Active Storage did not restrict any coders, so a crafted upload could trigger them. As a result, attackers may write arbitrary files. When the app stores attachments with the Disk service, attackers may also read any file the app can access. HackerOne researcher ryotak reported the flaw.
Active Storage video and extension handling (GHSA-v924-7rp8-4mxh, CVSS 8.8)
Active Storage kept the uploaded file’s extension when it handed files to FFmpeg and ImageMagick. Those tools choose a decoder from the extension, so the attacker could pick the decoder. On an FFmpeg built with AviSynth support, a “.avs” file runs as a script. That could leak files or load an attacker’s native library, “possibly leading to remote code execution.”
Strong Parameters bypass (GHSA-wm3x-v3qw-4jh3, CVSS 7.5)
Parameters#each_key returned the raw internal hash instead of the Parameters object. If an app passed that result to mass assignment, an attacker could set attributes “such as an authorization flag.” This is an incomplete fix of CVE-2020-8164. Rails itself makes no such call, so only custom code is at risk.
IP spoofing and DoS
Rails 8.1 reads the standard Forwarded header before X-Forwarded-For under Rack 3. Behind some proxies, attackers can therefore spoof request.remote_ip and dodge IP-based rate limits. Separately, a safe_constantize bug lets an unauthenticated Action Cable client crash the server process with crafted input.
Other fixes
The remaining issues include five XSS bugs and several session handling flaws. This Rails security update also fixes cache poisoning through content negotiation and signature replay in Action Mailbox Mailgun ingress.
Affected Versions
- Rails before 8.0.5.2
- Rails 8.1 before 8.1.4.1
- The IP spoofing and MessagePack XSS bugs affect only 8.1
For the critical ImageMagick bug, an app must use the mini_magick variant processor and accept untrusted uploads. That processor is the default for apps on load_defaults 6.1 or earlier. Rails warns that the ImageMagick policies “that Debian and Ubuntu package do not” block the coders involved.
Patch and Mitigation
- Install the Rails security update to 8.0.5.2 or 8.1.4.1.
- Use mini_magick 5.1 or later, or the app will fail to boot after upgrading.
- If you store attachments with the Disk service, rotate secret_key_base, the master key and every credential the app can read.
- If you cannot upgrade, copy the shipped ImageMagick policy into the system policy.xml.
- Strip client-supplied Forwarded headers at your reverse proxy.
Finally, plan a move to Rails 8.1 before 8.0 support ends. Full details are in the Rails 8.0.5.2 and 8.1.4.1 release announcement.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
