Rails patches 21 flaws, including critical file write bug

Rails has issued security updates for versions 8.0.5.2 and 8.1.4.1 to fix 21 flaws across Active Storage, parameters handling, IP spoofing, and several XSS and DoS issues. The most severe vulnerability, cited as critical (CVSS 9.8), would allow an unauthenticated attacker to write files on a Rails server via a crafted image upload. Four additional flaws are rated high. The Rails team urges upgrading to the patched releases promptly, noting security support for the 8.0 series ends on 7 November 2026.

Active Storage is the main vector in the advisory. One flaw arises from ImageMagick analysis: the ImageMagick analyser runs automatically when a file is attached, and a crafted upload could trigger code execution or file writes. A separate issue concerns handling of video and extension data, where the extension is retained when feeding files to FFmpeg and ImageMagick; an attacker could influence the decoder selection, potentially enabling remote code execution via a specially crafted file.

Other fixes include a Strong Parameters bypass risk (related to Parameters#each_key exposing raw internal hashes, potentially enabling mass-assignment of attributes), IP spoofing via Forwarded headers under Rack 3, and a safe_constantize bug that could crash an unauthenticated Action Cable client. Five XSS bugs and various session-handling flaws are also addressed, along with cache poisoning and signature replay in Action Mailbox ingress.

Affected versions are Rails before 8.0.5.2 and Rails 8.1 before 8.1.4.1, with IP spoofing and MessagePack XSS concerns limited to 8.1. The patch requires upgrading to 8.0.5.2 or 8.1.4.1 and, for Disk storage, rotating secrets and credentials. If upgrading is not possible, Rails advises applying the supplied ImageMagick policy or restricting Forwarded headers at the reverse proxy. The release notice also stresses moving to Rails 8.1 before 8.0 end-of-support. The advisory cites the Rails 8.0.5[.]2 and 8.1.4[.]1 release announcement for full details.