# Critical Rails Active Storage Flaw (GHSA-f3w6-w445-fwh9) Lets Attackers Write Server Files via Crafted ImageMagick Uploads

> A critical flaw in Rails Active Storage's ImageMagick integration lets an uploaded SVG reach ImageMagick's MSL coder, enabling arbitrary file write and read on the server. It affects apps that accept untrusted uploads and run ImageMagick with its default policy. It is fixed in Rails 8.1.4.1 and 8.0.5.2; no in-the-wild exploitation has been reported.

- **Published:** 2026-11-04T12:30:25Z
- **Last reviewed:** 2026-11-04T12:30:25Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5235
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5235.png
- **ID:** TL-2026-5235
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 11
- **CVEs:** CVE-2026-66066, CVE-2025-24293

## Description

GHSA-f3w6-w445-fwh9 is a critical (CVSS 9.8) vulnerability in the ImageMagick integration of Rails Active Storage. No CVE has been assigned and the weakness is classed CWE-1188 (Initialization with Insecure Default). ImageMagick picks a format handler, called a coder, from the file's content, and some coders act on other files named inside the image. An uploaded SVG can therefore be routed to ImageMagick's MSL (Magick Scripting Language) coder, which can read and write arbitrary files.

The Active Storage ImageMagick analyzer runs automatically when a file is attached. The attacker does not need the application to generate a variant or preview, and the app does not need to call analysis explicitly. A single crafted upload is enough to reach the vulnerable code path.

An app is vulnerable only if all three conditions hold: it uses ImageMagick for Active Storage (config.active_storage.variant_processor = :mini_magick), it runs an unmodified ImageMagick policy (the Debian/Ubuntu defaults do not block the exploit), and it accepts untrusted file uploads. Impact is arbitrary file write to the server disk and read of any file the app process can access, including secret_key_base and credentials. Remote code execution or lateral movement is possible as a follow-on. The advisory says one attack chain was reported and that Rails does not assume it is the only one. The advisory credits the reporter as RyotaK (GMO Flatt Security), who reported through HackerOne.

The fix adds a shipped ImageMagick policy (activestorage/lib/active_storage/image_magick/policy.xml). It is prepended to MAGICK_CONFIGURE_PATH through MiniMagick.cli_env, so it adds to the host policy instead of replacing it. The policy denies the MSL coder, file-access coders (TEXT, EPHEMERAL, MPC, FILE, XPS, PCL), display coders (SHOW, WIN, PLT), network coders (URL, HTTP, HTTPS, FTP), Ghostscript-backed coders and the gs delegate, and @filename indirection. The fix requires mini_magick 5.1 or later, enforced at boot. Apps that render PostScript or PDF must re-allow those coders in the host policy. GraphicsMagick users get no protection from the shipped policy.

A separate Active Storage flaw, GHSA-v924-7rp8-4mxh (CVSS 8.8, CWE-646), was fixed in the same releases. Temporary files kept the uploaded file's extension, and external tools such as FFmpeg and ImageMagick use that extension to choose a decoder. An attacker could therefore trigger arbitrary file disclosure or remote code execution, notably through FFmpeg's AviSynth support when enabled. It was reported by Pirikara through HackerOne. The releases fix 21 security issues in total.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505.003 Server Software Component: Web Shell
- T1552.001 Unsecured Credentials: Credentials In Files
- T1005 Data from Local System
- T1565.001 Data Manipulation: Stored Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5235 Rails Active Storage ImageMagick MSL Coder / @file Indirection or Risky File Write by ImageMagick** (`TL-2026-5235-SPL-001`)

Behaviour-first detection for GHSA-f3w6-w445-fwh9 (Rails Active Storage, uploaded SVG routed to the ImageMagick MSL coder for arbitrary file read/write). Fires on (1) ImageMagick binaries launched with an msl:/mvg:/url:/text:/ephemeral: coder prefix or @filename indirection, the primitives the shipped Rails policy.xml denies, and (2) ImageMagick binaries creating scripts, cron/authorized_keys entries or files with code extensions, the observable effect of a successful MSL write. Content-sniffed SVG to MSL routing does not put msl: on the command line, so the file-write branch is the primary signal. No in-the-wild exploitation is reported; this is proactive coverage.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059, T1505.003
- **Data sources:** sysmon_for_linux, index=linux sourcetype=sysmon:linux, DeviceProcessEvents, DeviceFileEvents, linux process_creation
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=linux sourcetype="sysmon:linux" (EventCode=1 OR EventCode=11) earliest=-24h
| regex Image="/(magick|convert|identify|mogrify|composite|montage)(-im[67]([.]q[0-9]+)?)?$"
| eval cmd=coalesce(CommandLine,"")
| eval coder_or_indirection=if(EventCode=1 AND (match(cmd,"(?i)(^|[[:space:]\x22\x27])(msl|mvg|ephemeral|text|url|https?|ftp|file|mpc|xps|pcl|show|win|plt):") OR match(cmd,"(^|[[:space:]\x22\x27])@[[:alnum:]_./-]+")),1,0)
| eval risky_write=if(EventCode=11 AND match(TargetFilename,"(?i)([.](rb|erb|php|jsp|sh|py|pl|so|msl|mvg)$|^/(etc/cron|var/spool/cron)|/[.]ssh/authorized_keys$)"),1,0)
| where coder_or_indirection=1 OR risky_write=1
| eval signal=if(coder_or_indirection=1,"coder_prefix_or_indirection","imagemagick_risky_file_write")
| stats count min(_time) as first_seen max(_time) as last_seen values(cmd) as command_lines values(TargetFilename) as written_files values(ParentImage) as parent_images by host, User, Image, signal
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let im_bins = @"^(magick|convert|identify|mogrify|composite|montage)(-im[67]([.]q[0-9]+)?)?$";
let coder_cmd = DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName matches regex im_bins
    | where ProcessCommandLine matches regex @"(?i)(^|[[:space:]\x22\x27])(msl|mvg|ephemeral|text|url|https?|ftp|file|mpc|xps|pcl|show|win|plt):" or ProcessCommandLine matches regex @"(^|[[:space:]\x22\x27])@[[:alnum:]_./-]+"
    | project Timestamp, DeviceName, AccountName, Signal = "coder_prefix_or_indirection", Detail = ProcessCommandLine, Writer = FileName, ParentProcess = InitiatingProcessFileName, ParentCmd = InitiatingProcessCommandLine;
let risky_write = DeviceFileEvents
    | where Timestamp > ago(24h)
    | where ActionType in ("FileCreated", "FileModified", "FileRenamed")
    | where InitiatingProcessFileName matches regex im_bins
    | where FolderPath matches regex @"(?i)([.](rb|erb|php|jsp|sh|py|pl|so|msl|mvg)$|^/(etc/cron|var/spool/cron)|/[.]ssh/authorized_keys$)"
    | project Timestamp, DeviceName, AccountName, Signal = "imagemagick_risky_file_write", Detail = FolderPath, Writer = InitiatingProcessFileName, ParentProcess = InitiatingProcessParentFileName, ParentCmd = InitiatingProcessCommandLine;
union coder_cmd, risky_write
| sort by Timestamp desc
```

### Sigma

```yaml
title: ImageMagick Launched With MSL/Coder Prefix or @file Indirection (Rails Active Storage GHSA-f3w6-w445-fwh9)
id: 7c1f3a52-9b0e-4d6a-8f21-3e5a1b7c9d01
status: experimental
description: Detects ImageMagick binaries started with an msl, mvg, url, text or ephemeral style coder prefix or @filename indirection, the primitives abused in the Rails Active Storage ImageMagick MSL arbitrary file read/write flaw and denied by the policy shipped in Rails 8.1.4.1 and 8.0.5.2.
references:
    - https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9
    - https://github.com/rails/rails/commit/468aa9a93fc98f5476b6821770f4ccfcb7f7d328
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
    - attack.initial_access
    - attack.t1190
    - attack.execution
    - attack.t1059
    - attack.persistence
    - attack.t1505.003
logsource:
    category: process_creation
    product: linux
detection:
    img:
        Image|re: '/(magick|convert|identify|mogrify|composite|montage)(-im[67]([.]q[0-9]+)?)?$'
    cmd_coder:
        CommandLine|re: '(?i)(^|[[:space:]\x22\x27])(msl|mvg|ephemeral|text|url|https?|ftp|file|mpc|xps|pcl|show|win|plt):'
    cmd_indirect:
        CommandLine|re: '(^|[[:space:]\x22\x27])@[[:alnum:]_./-]+'
    condition: img and 1 of cmd_*
falsepositives:
    - Image pipelines that deliberately use text, url or @listfile syntax
    - Administrators running ImageMagick manually with coder prefixes
level: high
```

**Known false positives:**

- Legitimate image pipelines that use text:, url: or @listfile ImageMagick syntax
- Build or deployment jobs where ImageMagick writes generated scripts under an app tree

**Tuning notes:** Scope Image to hosts running Rails Active Storage with variant_processor = :mini_magick. Exclude known build users and CI paths. Replace index=linux with your Sysmon-for-Linux index. Once the Rails 8.1.4.1/8.0.5.2 policy is verified, keep this as a regression detector for policy bypasses.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5235 Active Storage Direct Upload Burst or SVG Blob Request at Edge (locked: unlock with TL Creds)
- TL-2026-5235 ImageMagick or [indicator] Worker Modifies Persistence Locations (cron, SSH keys, systemd, shell profiles) (locked: unlock with TL Creds)
- TL-2026-5235 [indicator] App Server Spawns Shell With Download, Reverse-Shell or Staging Command (locked: unlock with TL Creds)
- TL-2026-5235 Active Storage Temp File With Risky Extension Fed to ImageMagick or FFmpeg (locked: unlock with TL Creds)
- TL-2026-5235 ImageMagick policy.xml or delegates.xml Modified Outside Package Management (locked: unlock with TL Creds)
- TL-2026-5235 ImageMagick Binary Makes Outbound Network Connection (URL/HTTP/FTP Coder Abuse) (locked: unlock with TL Creds)
- TL-2026-5235 [indicator] Process or ImageMagick Writes Script/Web Shell Into Application Tree (locked: unlock with TL Creds)
- TL-2026-5235 ImageMagick or [indicator] Child Process Touching master.key, credentials, [indicator] or .env (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads](https://thehackernews.com/2026/11/critical-rails-flaw-lets-attackers.html)
- [Rails Security Advisory GHSA-f3w6-w445-fwh9](https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9)
- [Rails Security Advisory GHSA-v924-7rp8-4mxh (related Active Storage flaw)](https://github.com/rails/rails/security/advisories/GHSA-v924-7rp8-4mxh)
- [Fix commit (Rails 8.1): shipped ImageMagick policy](https://github.com/rails/rails/commit/468aa9a93fc98f5476b6821770f4ccfcb7f7d328)
- [Fix commit (Rails 8.0): shipped ImageMagick policy](https://github.com/rails/rails/commit/ea8c40121ce53a3d0255cd4eb6d13bfe3bc01776)
- [Active Storage Overview (Rails Guides)](https://guides.rubyonrails.org/active_storage_overview.html)
- [Active Storage CHANGELOG (8-1-stable)](https://github.com/rails/rails/blob/8-1-stable/activestorage/CHANGELOG.md)
- [Rails CVE-2026-66066: Patch Active Storage and Rotate Secrets (earlier libvips file-disclosure flaw)](https://blog.gridinsoft.com/rails-active-storage-cve-2026-66066/)
- [CVE-2026-66066: Rails Active Storage arbitrary file read and RCE](https://www.herodevs.com/blog-posts/cve-2026-66066-rails-active-storage-arbitrary-file-read-and-rce)
- [CVE-2025-24293: Active Storage allowed transformation methods potentially unsafe (earlier related Active Storage/ImageMagick issue)](https://discuss.rubyonrails.org/t/cve-2025-24293-active-storage-allowed-transformation-methods-potentially-unsafe/89670)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5235