Critical Rails Active Storage Flaw (GHSA-f3w6-w445-fwh9) Lets Attackers Write Server Files via Crafted ImageMagick Uploads

Key facts for Rails Active Storage ImageMagick flaw

Detection coverage for Rails Active Storage ImageMagick flaw

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5235 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-5235 Rails Active Storage ImageMagick MSL Coder / @file Indirection or Risky File Write by ImageMagick

Behaviour-first detection for GHSA-f3w6-w445-fwh9 (Rails Active Storage, uploaded SVG routed to the ImageMagick MSL coder for arbitrary file read/write). Fires on (1) ImageMagick binaries launched with an msl:/mvg:/url:/text:/ephemeral: coder prefix or @filename indirection, the primitives the shipped Rails policy.xml denies, and (2) ImageMagick binaries creating scripts, cron/authorized_keys entries or files with code extensions, the observable effect of a successful MSL write. Content-sniffed SVG to MSL routing does not put msl: on the command line, so the file-write branch is the primary signal. No in-the-wild exploitation is reported; this is proactive coverage.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059, T1505.003
• Data sources: sysmon_for_linux, index=linux sourcetype=sysmon:linux, DeviceProcessEvents, DeviceFileEvents, linux process_creation
• Severity: high
• Confidence: medium

Splunk SPL

index=linux sourcetype="sysmon:linux" (EventCode=1 OR EventCode=11) earliest=-24h
| regex Image="/(magick|convert|identify|mogrify|composite|montage)(-im[67]([.]q[0-9]+)?)?$"
| eval cmd=coalesce(CommandLine,"")
| eval coder_or_indirection=if(EventCode=1 AND (match(cmd,"(?i)(^|[[:space:]\x22\x27])(msl|mvg|ephemeral|text|url|https?|ftp|file|mpc|xps|pcl|show|win|plt):") OR match(cmd,"(^|[[:space:]\x22\x27])@[[:alnum:]_./-]+")),1,0)
| eval risky_write=if(EventCode=11 AND match(TargetFilename,"(?i)([.](rb|erb|php|jsp|sh|py|pl|so|msl|mvg)$|^/(etc/cron|var/spool/cron)|/[.]ssh/authorized_keys$)"),1,0)
| where coder_or_indirection=1 OR risky_write=1
| eval signal=if(coder_or_indirection=1,"coder_prefix_or_indirection","imagemagick_risky_file_write")
| stats count min(_time) as first_seen max(_time) as last_seen values(cmd) as command_lines values(TargetFilename) as written_files values(ParentImage) as parent_images by host, User, Image, signal
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let im_bins = @"^(magick|convert|identify|mogrify|composite|montage)(-im[67]([.]q[0-9]+)?)?$";
let coder_cmd = DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName matches regex im_bins
    | where ProcessCommandLine matches regex @"(?i)(^|[[:space:]\x22\x27])(msl|mvg|ephemeral|text|url|https?|ftp|file|mpc|xps|pcl|show|win|plt):" or ProcessCommandLine matches regex @"(^|[[:space:]\x22\x27])@[[:alnum:]_./-]+"
    | project Timestamp, DeviceName, AccountName, Signal = "coder_prefix_or_indirection", Detail = ProcessCommandLine, Writer = FileName, ParentProcess = InitiatingProcessFileName, ParentCmd = InitiatingProcessCommandLine;
let risky_write = DeviceFileEvents
    | where Timestamp > ago(24h)
    | where ActionType in ("FileCreated", "FileModified", "FileRenamed")
    | where InitiatingProcessFileName matches regex im_bins
    | where FolderPath matches regex @"(?i)([.](rb|erb|php|jsp|sh|py|pl|so|msl|mvg)$|^/(etc/cron|var/spool/cron)|/[.]ssh/authorized_keys$)"
    | project Timestamp, DeviceName, AccountName, Signal = "imagemagick_risky_file_write", Detail = FolderPath, Writer = InitiatingProcessFileName, ParentProcess = InitiatingProcessParentFileName, ParentCmd = InitiatingProcessCommandLine;
union coder_cmd, risky_write
| sort by Timestamp desc

Sigma

title: ImageMagick Launched With MSL/Coder Prefix or @file Indirection (Rails Active Storage GHSA-f3w6-w445-fwh9)
id: 7c1f3a52-9b0e-4d6a-8f21-3e5a1b7c9d01
status: experimental
description: Detects ImageMagick binaries started with an msl, mvg, url, text or ephemeral style coder prefix or @filename indirection, the primitives abused in the Rails Active Storage ImageMagick MSL arbitrary file read/write flaw and denied by the policy shipped in Rails 8.1.4.1 and 8.0.5.2.
references:
    - https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9
    - https://github.com/rails/rails/commit/468aa9a93fc98f5476b6821770f4ccfcb7f7d328
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
    - attack.initial_access
    - attack.t1190
    - attack.execution
    - attack.t1059
    - attack.persistence
    - attack.t1505.003
logsource:
    category: process_creation
    product: linux
detection:
    img:
        Image|re: '/(magick|convert|identify|mogrify|composite|montage)(-im[67]([.]q[0-9]+)?)?$'
    cmd_coder:
        CommandLine|re: '(?i)(^|[[:space:]\x22\x27])(msl|mvg|ephemeral|text|url|https?|ftp|file|mpc|xps|pcl|show|win|plt):'
    cmd_indirect:
        CommandLine|re: '(^|[[:space:]\x22\x27])@[[:alnum:]_./-]+'
    condition: img and 1 of cmd_*
falsepositives:
    - Image pipelines that deliberately use text, url or @listfile syntax
    - Administrators running ImageMagick manually with coder prefixes
level: high

Known false positives:

• Legitimate image pipelines that use text:, url: or @listfile ImageMagick syntax
• Build or deployment jobs where ImageMagick writes generated scripts under an app tree

Tuning notes: Scope Image to hosts running Rails Active Storage with variant_processor = :mini_magick. Exclude known build users and CI paths. Replace index=linux with your Sysmon-for-Linux index. Once the Rails 8.1.4.1/8.0.5.2 policy is verified, keep this as a regression detector for policy bypasses.

• 🔒 TL-2026-5235 Active Storage Direct Upload Burst or SVG Blob Request at Edge · unlock with TL Creds
• 🔒 TL-2026-5235 ImageMagick or [indicator] Worker Modifies Persistence Locations (cron, SSH keys, systemd, shell profiles) · unlock with TL Creds
• 🔒 TL-2026-5235 [indicator] App Server Spawns Shell With Download, Reverse-Shell or Staging Command · unlock with TL Creds
• 🔒 TL-2026-5235 Active Storage Temp File With Risky Extension Fed to ImageMagick or FFmpeg · unlock with TL Creds
• 🔒 TL-2026-5235 ImageMagick policy.xml or delegates.xml Modified Outside Package Management · unlock with TL Creds
• 🔒 TL-2026-5235 ImageMagick Binary Makes Outbound Network Connection (URL/HTTP/FTP Coder Abuse) · unlock with TL Creds
• 🔒 TL-2026-5235 [indicator] Process or ImageMagick Writes Script/Web Shell Into Application Tree · unlock with TL Creds
• 🔒 TL-2026-5235 ImageMagick or [indicator] Child Process Touching master.key, credentials, [indicator] or .env · unlock with TL Creds

Indicators of compromise for Rails Active Storage ImageMagick flaw

As of 2026-11-04, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-5235.

How Rails Active Storage ImageMagick flaw works

It is fixed in Rails 8.1.4.1 and 8.0.5.2; no in-the-wild exploitation has been reported.

GHSA-f3w6-w445-fwh9 is a critical (CVSS 9.8) vulnerability in the ImageMagick integration of Rails Active Storage. No CVE has been assigned and the weakness is classed CWE-1188 (Initialization with Insecure Default). ImageMagick picks a format handler, called a coder, from the file's content, and some coders act on other files named inside the image. An uploaded SVG can therefore be routed to ImageMagick's MSL (Magick Scripting Language) coder, which can read and write arbitrary files.

The Active Storage ImageMagick analyzer runs automatically when a file is attached. The attacker does not need the application to generate a variant or preview, and the app does not need to call analysis explicitly. A single crafted upload is enough to reach the vulnerable code path.

An app is vulnerable only if all three conditions hold: it uses ImageMagick for Active Storage (config.active_storage.variant_processor = :mini_magick), it runs an unmodified ImageMagick policy (the Debian/Ubuntu defaults do not block the exploit), and it accepts untrusted file uploads. Impact is arbitrary file write to the server disk and read of any file the app process can access, including secret_key_base and credentials. Remote code execution or lateral movement is possible as a follow-on. The advisory says one attack chain was reported and that Rails does not assume it is the only one. The advisory credits the reporter as RyotaK (GMO Flatt Security), who reported through HackerOne.

The fix adds a shipped ImageMagick policy (activestorage/lib/active_storage/image_magick/policy.xml). It is prepended to MAGICK_CONFIGURE_PATH through MiniMagick.cli_env, so it adds to the host policy instead of replacing it. The policy denies the MSL coder, file-access coders (TEXT, EPHEMERAL, MPC, FILE, XPS, PCL), display coders (SHOW, WIN, PLT), network coders (URL, HTTP, HTTPS, FTP), Ghostscript-backed coders and the gs delegate, and @filename indirection. The fix requires mini_magick 5.1 or later, enforced at boot. Apps that render PostScript or PDF must re-allow those coders in the host policy. GraphicsMagick users get no protection from the shipped policy.

A separate Active Storage flaw, GHSA-v924-7rp8-4mxh (CVSS 8.8, CWE-646), was fixed in the same releases. Temporary files kept the uploaded file's extension, and external tools such as FFmpeg and ImageMagick use that extension to choose a decoder. An attacker could therefore trigger arbitrary file disclosure or remote code execution, notably through FFmpeg's AviSynth support when enabled. It was reported by Pirikara through HackerOne. The releases fix 21 security issues in total.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1190 Exploit Public-Facing Application

Persistence

T1505.003 Server Software Component: Web Shell

Credential Access

T1552.001 Unsecured Credentials: Credentials In Files

Impact

T1565.001 Data Manipulation: Stored Data Manipulation

Remediation for Rails Active Storage ImageMagick flaw

Patches

• Rails 8.1.4.1
• Rails 8.0.5.2
• mini_magick 5.1 or later

Immediate actions

• Upgrade Rails to 8.1.4.1 or 8.0.5.2
• Ensure mini_magick >= 5.1 when using the :mini_magick variant processor
• Verify the active ImageMagick policy with: bin/rails runner 'puts MiniMagick.identify { |i| i.list "policy" }'
• If the app was exposed with untrusted uploads, rotate every secret the app process can access (master key, credentials, secret_key_base, database, storage and third-party credentials)

Workarounds

• If upgrading is not possible, copy the rules from activestorage/lib/active_storage/image_magick/policy.xml into the system policy (for example /etc/ImageMagick-7/policy.xml)
• Add <policy domain="coder" rights="none" pattern="MSL"/> and <policy domain="delegate" rights="none" pattern="gs"/> to the ImageMagick policy
• Deny Ghostscript-backed coders (PS, PS2, PS3, EPS, EPS2, EPS3, EPI, EPSF, EPSI, EPT, EPT2, EPT3, PDF, AI, EPDF, PDFA, POCKETMOD, XPS, PCL) in the ImageMagick policy
• GraphicsMagick users must apply equivalent restrictions themselves

Longer-term hardening

• Keep an explicit restrictive ImageMagick policy.xml that denies MSL, file-access, network and Ghostscript-backed coders
• Restrict accepted upload content types and do not process untrusted SVG with ImageMagick
• Plan migration off Rails 8.0, which receives security fixes only until 2026-11-07

Affected and fixed versions

• Ruby on Rails — Active Storage (activestorage)
  Vulnerable versions: < 8.0.5.2; >= 8.1, < 8.1.4.1
  Fixed in: 8.0.5.2; 8.1.4.1
• ImageMagick — ImageMagick (MSL coder reachable through Active Storage with default policy)
  Vulnerable versions: Installations with an unmodified policy.xml, including Debian/Ubuntu defaults
  Fixed in: Policy denying MSL and related coders (shipped by Rails fix)

Timeline of Rails Active Storage ImageMagick flaw

• 2026-07-29 locked-ioc-10 advisory for CVE-2026-66066 (CVSS 4.0 9.5): Active Storage did not disable unsafe locked-ioc-8 operations, allowing arbitrary file read; fixed in 7.2.3.2, 8.0.5.1 and 8.1.3.1. An earlier, related Active Storage image-processing flaw that locked-ioc-10 patched months before this one.
• 2026-11-04 The Hacker News reports the flaw; no confirmed in-the-wild exploitation and no public PoC mentioned.
• 2026-11-04 GHSA-v924-7rp8-4mxh (CVSS 8.8, CWE-646, reported by Pirikara) fixed in the same releases; temporary files kept upload extensions and so influenced external decoder selection.
• 2026-11-04 locked-ioc-10 8.1.4.1 and 8.0.5.2 released with a shipped locked-ioc-7 policy blocking MSL and related coders, and a requirement for locked-ioc-6 5.1 or later.
• 2026-11-04 locked-ioc-10 publishes GHSA-f3w6-w445-fwh9 (CVSS 9.8, no CVE assigned), reported by RyotaK (GMO Flatt Security) via HackerOne.
• 2026-11-07 locked-ioc-10 8.0 receives security fixes only until this date, so operators on 8.0 should plan to move to 8.1.

Sources cited for Rails Active Storage ImageMagick flaw

• Rails Security Advisory GHSA-f3w6-w445-fwh9 GitHub · Advisory · 2026-11-04
• Rails Security Advisory GHSA-v924-7rp8-4mxh (related Active Storage flaw) GitHub · Advisory · 2026-11-04
• CVE-2025-24293: Active Storage allowed transformation methods potentially unsafe (earlier related Active Storage/ImageMagick issue) discuss.rubyonrails.org · Advisory
• Active Storage Overview (Rails Guides) guides.rubyonrails.org · Vendor report
• Fix commit (Rails 8.1): shipped ImageMagick policy GitHub · Code repository · 2026-11-04
• Fix commit (Rails 8.0): shipped ImageMagick policy GitHub · Code repository · 2026-11-04
• Active Storage CHANGELOG (8-1-stable) GitHub · Code repository
• Rails CVE-2026-66066: Patch Active Storage and Rotate Secrets (earlier libvips file-disclosure flaw) blog.gridinsoft.com · Blog
• CVE-2026-66066: Rails Active Storage arbitrary file read and RCE herodevs.com · Blog
• Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads The Hacker News · News · 2026-11-04

More in vulnerability

• Google Chrome 157 Security Update Fixes 213 Bugs Including 7 Critical Vulnerabilities (CVE-2026-121156, CVE-2026-121247, CVE-2026-121229, CVE-2026-121246, CVE-2026-121035, CVE-2026-121203, CVE-2026-121126)
• rsync CPU Exhaustion via Algorithmic Complexity in hash_search() (CVE-2026-119741) - Fixed in 3.5.2
• CVE-2025-42611: Authentication bypass in multiple MikroTik RouterOS services via improper certificate validation (shared trust store)
• CVE-2026-25599: Missing Authentication, Clear-Text Transmission and Stored XSS in Orca Heat Pumps and Orca User Portal
• SolarWinds Dameware Command Injection Vulnerability (CVE-2026-28336)