Rails patches a critical file-write bug in Active Storage

Rails patched a critical vulnerability in Active Storage on 4 November. Any app that uses ImageMagick to process uploaded images runs an analyzer that can be pointed at ImageMagick’s MSL coder, which acts on files referenced inside an image rather than the image itself. A crafted upload, with no login required, can use that to write arbitrary files to the server, or, if you use the Disk storage service, read them back, including secret_key_base and other credentials.

The advisory rates it CVSS 9.8, critical: network attack vector, no privileges or user interaction needed. It affects activestorage before 8.0.5.2, and 8.1 before 8.1.4.1. Both are now fixed. Rails also recommends upgrading mini_magick to 5.1 or later and locking down ImageMagick’s own policy so the dangerous coders can’t run at all:

<policy domain="coder" rights="none" pattern="MSL" />
<policy domain="coder" rights="none" pattern="{PS,PDF,XPS}" />

Why it matters: if your app processes uploads through Active Storage with ImageMagick, this is remotely triggerable by anyone, no account needed, and the read path can hand over the secrets that unlock the rest of your app. Upgrade now, and if you serve files from local disk storage, rotate secret_key_base and any other credentials once you’ve patched.

The caveat: the advisory doesn’t report exploitation in the wild yet, but the write primitive became public the moment the patch shipped, so don’t treat this as routine dependency hygiene.