{"type":"bundle","id":"bundle--b72c334f-f7f3-5120-bc4e-db4b3bb72caf","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--aa4909cd-46b8-578e-8f37-e17ec1d0d99c","created":"2026-11-04T03:34:28.163Z","modified":"2026-11-04T03:34:28.163Z","name":"Rails Active Storage: a crafted upload can write and read files on the server through ImageMagick and FFmpeg (GHSA-f3w6-w445-fwh9, GHSA-v924-7rp8-4mxh)","description":"On 2026-11-04 (UTC) Rails released 8.0.5.2 and 8.1.4.1, fixing 21 security issues. GHSA-f3w6-w445-fwh9 (Critical, CVSS 9.8): Active Storage ran ImageMagick analysis on attach with no coder restrictions, so an unauthenticated attacker who can upload a crafted file may write arbitrary files on the server and, with the Disk service, read files readable by the app process such as secret_key_base. It affects apps using variant_processor :mini_magick (default on load_defaults 6.1 or earlier) under an ImageMagick policy that does not deny the coders involved (Debian and Ubuntu policies do not). GHSA-v924-7rp8-4mxh (High, CVSS 8.8): Active Storage kept the uploaded extension on tempfiles passed to ffprobe, ffmpeg and ImageMagick, letting the uploader pick the decoder; an FFmpeg built with AviSynth evaluates .avs files as scripts, which could disclose files through a preview image or load an uploaded native library. Both affect activestorage < 8.0.5.2 and >= 8.1, < 8.1.4.1. No CVE IDs, not on CISA KEV, and no known exploitation at publication.","aliases":["GHSA-f3w6-w445-fwh9","GHSA-v924-7rp8-4mxh","Rails Active Storage ImageMagick file write","Rails 8.1.4.1 security release","Rails 8.0.5.2 security release","activestorage arbitrary file read"],"first_seen":"2026-11-04T03:02:13.000Z","last_seen":"2026-11-04T03:25:23.000Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"GHSA-f3w6-w445-fwh9: Possible arbitrary file write and read in Active Storage image analysis","url":"https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9"},{"source_name":"GHSA-v924-7rp8-4mxh: Possible arbitrary file read and remote code execution in Active Storage video previews, analysis and image processing","url":"https://github.com/rails/rails/security/advisories/GHSA-v924-7rp8-4mxh"},{"source_name":"Rails Versions 8.0.5.2 and 8.1.4.1 have been released","url":"https://rubyonrails.org/2026/11/4/Rails-8.0.5.2-and-8.1.4.1-have-been-released"},{"source_name":"ImageMagick security policy","url":"https://imagemagick.org/security-policy/"},{"source_name":"HOL: A crafted photo upload can read and write files on Rails servers","url":"https://hol.org/blog/rails-active-storage-upload-file-read-write-ghsa-f3w6-w445-fwh9"}]}]}