L3 · ShartedRails · Active Storage · RCErails-november-security

Rails fixes Active Storage file access and code execution in a 21-advisory security release

Rails 8.0.5.2 and 8.1.4.1 fix 21 issues, including crafted-upload file access and possible code execution in Active Storage. ImageMagick policy, Disk storage and FFmpeg build options determine exposure. Update Rails and mini_magick, review GCS upload CORS, and rotate potentially exposed secrets. No real-world attacks are established.

Disclosed: Nov 4, 2026; Public disclosure date
Severity: Sharted; 2 CVEs tracked here
Splash zone: Rails accepting untrusted attachments processed by ImageMagick or FFmpeg; other batch flaws have separate configuration prerequisites.; Rails · Active Storage · RCE
In the wild: Unknown; Vendor advisories describe attack paths, not confirmed real-world exploitation.

What happened

This is one coordinated Rails release, not 21 separate incidents. The two upload-processing advisories detailed above affect activestorage below 8.0.5.2 and 8.1 releases before 8.1.4.1. They are configuration-dependent; neither a default modern Rails deployment nor every FFmpeg build is necessarily exposed. No victim count or confirmed in-the-wild campaign is established.

For the ImageMagick flaw, untrusted attachment uploads and a permissive coder policy are enough to reach analysis. Disk storage adds the documented arbitrary-read exposure; file contents can include credentials that enable further attacks. For the decoder flaw, attacker-chosen filename extensions influence external processing; the described native-library execution route needs additional AviSynth build/runtime support. Lack of AviSynth does not address all extension-driven decoding risks.

The other 19 advisories cover parameter handling, IP spoofing, XSS, denial of service, GCS direct uploads, session handling, cache negotiation and Mailgun signature replay. The complete batch and individual configuration prerequisites are linked in the release and sources. Upgrading the batch is preferable to assuming only the two highlighted paths matter. GCS CORS, processing policies, dependency compatibility and secret replacement need explicit checks beyond changing a version number. The new policy denies dangerous coders and delegates; do not broadly re-enable them to make a failing workflow pass.

What’s in the bowl

GHSA-f3w6-w445-fwh9

ImageMagick attachment analysis file write/read

Untrusted attachments reach unsafe ImageMagick coders; arbitrary writes and, with Disk storage, reads may expose application secrets and enable further code execution.

GHSA-v924-7rp8-4mxh

Upload filename selects an unsafe media decoder

Attacker-chosen extensions can select FFmpeg/ImageMagick decoders. The AviSynth path additionally needs an AviSynth-enabled FFmpeg and AviSynthPlus runtime.

Fixed versions

Product	Safe from	Note
Rails 8.0 / affected component gems	`8.0.5.2`	Security support for Rails 8.0 ends November 7, 2026
Rails 8.1 / affected component gems	`8.1.4.1`	Security release
Older Rails lines	No fix	Unsupported; migrate to a supported line
mini_magick for :mini_magick applications	`5.1`	Minimum required for the shipped policy; not a standalone Rails fix

Crime-scene timeline

Nov 4, 2026
Rails releases both supported-line security updates
The batch addresses 21 advisories; the critical ImageMagick and high-severity media-decoder issues have no assigned CVE in their original records.

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

Rails November 4 security releasePrimary21-advisory batch, fixed versions, maintenance deadline and links to each original advisory.
Rails GHSA-f3w6-w445-fwh9PrimaryMaintainer-authored original read through its public GitHub API; configuration-specific impact, patches and mitigation.
Rails GHSA-v924-7rp8-4mxhPrimaryMaintainer-authored original read through its public GitHub API; configuration-specific impact, patches and mitigation.
Rails GHSA-wm3x-v3qw-4jh3PrimaryMaintainer-authored original read through its public GitHub API; configuration-specific impact, patches and mitigation.
Rails GHSA-2gff-2mmg-m73pPrimaryMaintainer-authored original read through its public GitHub API; configuration-specific impact, patches and mitigation.
Rails GHSA-8474-xrp6-wh69PrimaryMaintainer-authored original read through its public GitHub API; configuration-specific impact, patches and mitigation.
Rails GHSA-2p2f-4rq4-gjwcPrimaryMaintainer-authored original read through its public GitHub API; configuration-specific impact, patches and mitigation.
Rails GHSA-v6rj-xm57-3p59PrimaryMaintainer-authored original read through its public GitHub API; configuration-specific impact, patches and mitigation.
Rails GHSA-rq8q-p985-fjq7PrimaryMaintainer-authored original read through its public GitHub API; configuration-specific impact, patches and mitigation.
Rails GHSA-68p9-83h6-5wpjPrimaryMaintainer-authored original read through its public GitHub API; configuration-specific impact, patches and mitigation.
Rails GHSA-2w9f-fxwj-w2qfPrimaryMaintainer-authored original read through its public GitHub API; configuration-specific impact, patches and mitigation.
Rails GHSA-rwvh-fw6r-pwvpPrimaryMaintainer-authored original read through its public GitHub API; configuration-specific impact, patches and mitigation.
Rails GHSA-4v2w-w6g6-f8f8PrimaryMaintainer-authored original read through its public GitHub API; configuration-specific impact, patches and mitigation.
Rails GHSA-p2pm-g2h6-7j5jPrimaryMaintainer-authored original read through its public GitHub API; configuration-specific impact, patches and mitigation.
Rails GHSA-3w93-6hmw-whh4PrimaryMaintainer-authored original read through its public GitHub API; configuration-specific impact, patches and mitigation.
Rails GHSA-hfr4-8rjc-97m2PrimaryMaintainer-authored original read through its public GitHub API; configuration-specific impact, patches and mitigation.
Rails GHSA-2586-8ghr-69fjPrimaryMaintainer-authored original read through its public GitHub API; configuration-specific impact, patches and mitigation.
Rails GHSA-x6mj-8jx9-qhqvPrimaryMaintainer-authored original read through its public GitHub API; configuration-specific impact, patches and mitigation.
Rails GHSA-r9jg-fmfx-2gv6PrimaryMaintainer-authored original read through its public GitHub API; configuration-specific impact, patches and mitigation.
Rails GHSA-3f4q-8x5m-76v8PrimaryMaintainer-authored original read through its public GitHub API; configuration-specific impact, patches and mitigation.
Rails GHSA-5957-c7qm-m469PrimaryMaintainer-authored original read through its public GitHub API; configuration-specific impact, patches and mitigation.
Rails GHSA-gmj8-hvj3-49mwPrimaryMaintainer-authored original read through its public GitHub API; configuration-specific impact, patches and mitigation.

Wipe guide

The wipe checklist

0 of 5 sheets used

Upgrade the deployed Rails gems and check bootCheck Gemfile.lock and the deployed bundle for Rails/activestorage and other component gems. Upgrade to 8.0.5.2 or 8.1.4.1 and redeploy. Applications using :mini_magick also need mini_magick >=5.1 or the new policy raises a boot error. Rails 8.0 security support ends November 7, 2026; plan migration.
Audit image and media processing before accepting uploadsCheck config.active_storage.variant_processor, load_defaults and ImageMagick policy. :mini_magick is the default for load_defaults 6.1 or earlier. Untrusted uploads plus policies permitting unsafe coders expose image analysis on attachment; no explicit variant/preview call is required. If unable to upgrade, apply the complete shipped policy from activestorage/lib/active_storage/image_magick/policy.xml to the host policy; the advisory’s minimum rules alone are not equivalent to the full policy. Review custom MiniMagick.cli_env/cli_prefix/Shell overrides and GraphicsMagick separately. PDF/PostScript workflows need careful policy testing.
Check FFmpeg build and disable risky processing if patching waitsThe described AviSynth execution path requires --enable-avisynth plus AviSynthPlus; upstream/common Linux/Homebrew builds do not enable it, but referenced GPL builds do. Other extension-selected decoders remain relevant. Until upgraded, remove VideoPreviewer from config.active_storage.previewers and VideoAnalyzer/AudioAnalyzer from config.active_storage.analyzers to stop Active Storage FFmpeg use; this does not fix ImageMagick. Test the fixed extension/content-type handling and allowed media formats.
Replace secrets reachable through vulnerable processingThe vendor directs Disk-storage/ImageMagick deployments and deployments meeting the AviSynth condition to change every secret readable by the application process: secret_key_base, the master key and decrypted config/credentials.yml.enc values, storage/database credentials and third-party tokens. Do this from a trusted environment and do not keep exposed secrets as rotation fallbacks. Changing secret_key_base expires sessions, signed/encrypted cookies, signed global IDs and Active Storage URLs; plan the user impact. Patching does not undo prior disclosure.
Test GCS uploads and session/cache changesFor GCS direct uploads, allow x-goog-content-length-range in the bucket CORS responseHeader after upgrading or browser uploads fail. Review the release’s separate GCS cache_control, CacheStore session-revocation, cookie rotation/Active Storage proxy-cache, SameSite and content-negotiation fixes against your configuration. Shared caches should not store Set-Cookie responses; do not assume every app meets every advisory’s prerequisites.