Rails Active Storage flaw can expose server secrets through crafted uploads
A critical flaw in Ruby on Rails Active Storage can let an unauthenticated user upload a crafted image and make the server write files. If uploads use the Disk service, the same upload can also make the server read files. The Rails team rated the bug Critical, gave it a CVSS score of 9.8, and published the advisory on November 4, 2026. ImageMagick behavior behind the flaw The issue starts…