Critical Ruby on Rails Active Storage Flaw (GHSA-f3w6-w445-fwh9) Allows Server Secret Theft via Malicious Image Uploads to ImageMagick (CVE not yet assigned)

Key facts for TL-2026-5254

Detection coverage for TL-2026-5254

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5254 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Active Storage ImageMagick Coder Abuse - Ghostscript or Shell Spawned by ImageMagick (GHSA-f3w6-w445-fwh9)

TL-2026-5254 / GHSA-f3w6-w445-fwh9: a crafted upload makes ImageMagick (via mini_magick, invoked by Rails activestorage on attach) select a dangerous coder or delegate based on file content. Because the coder is chosen from content, the payload is not visible in the command line; the reliable signal is process behaviour. ImageMagick binaries (magick, convert, identify, mogrify) should only spawn Ghostscript with -dSAFER and should never spawn shells, interpreters or downloaders. This rule flags the gs delegate running without -dSAFER (or with -dNOSAFER / %pipe%) and any non-gs child of ImageMagick. Behaviour-based from advisory mechanics; no public PoC or in-the-wild exploitation is reported for this flaw.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059, T1036.008
• Data sources: splunk_cim_endpoint_processes, sysmon_for_linux, linux_auditd_execve
• Severity: critical
• Confidence: high

Splunk SPL

| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("magick","convert","convert-im6.q16","identify","mogrify","magick-im6.q16") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process
| rename "Processes.*" as *
```Ghostscript delegate is only expected with -dSAFER; shells and downloaders are never expected under ImageMagick```
| where NOT (process_name="gs" AND match(process,"-dSAFER") AND NOT match(process,"(-dNOSAFER|%pipe%)"))
| convert ctime(firstTime) ctime(lastTime)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("magick","convert","convert-im6.q16","identify","mogrify","magick-im6.q16")
| where FileName !~ "gs" or ProcessCommandLine !contains "-dSAFER" or ProcessCommandLine has_any ("-dNOSAFER","%pipe%")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, FileName, ProcessCommandLine

Sigma

title: Rails Active Storage ImageMagick Spawns Ghostscript Without SAFER or Shell Child (GHSA-f3w6-w445-fwh9)
id: 3d0b6f1e-8a52-4c7e-b1f4-6a9e2c5d7101
status: experimental
description: Detects ImageMagick binaries spawning shells, interpreters or downloaders, or the Ghostscript delegate running without -dSAFER or with -dNOSAFER/%pipe%, consistent with coder abuse via crafted Active Storage uploads (TL-2026-5254, GHSA-f3w6-w445-fwh9).
references:
  - https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059
  - attack.defense-evasion
  - attack.t1036.008
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/magick'
      - '/convert'
      - '/convert-im6.q16'
      - '/identify'
      - '/mogrify'
      - '/magick-im6.q16'
  sub_shell:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/python3'
      - '/perl'
      - '/ruby'
  sub_gs_unsafe:
    Image|endswith: '/gs'
    CommandLine|contains:
      - '-dNOSAFER'
      - '%pipe%'
  sub_gs:
    Image|endswith: '/gs'
  filter_safe:
    CommandLine|contains: '-dSAFER'
  condition: selection_parent and (sub_shell or sub_gs_unsafe or (sub_gs and not filter_safe))
falsepositives:
  - Image pipelines that intentionally shell out from ImageMagick delegates
  - Legitimate PDF/PS preview generation through the gs delegate
level: high

Known false positives:

• Applications that legitimately render PDF/PS/EPS previews through ImageMagick and its gs delegate
• Custom ImageMagick delegates configured in delegates.xml that invoke helper scripts

Tuning notes: Populate the Endpoint.Processes data model from Sysmon for Linux or auditd execve (and map process_name/parent_process_name). Add ImageMagick binary names used by your distro (e.g. magick-im6.q16). If the app legitimately renders PDFs, keep the gs -dSAFER allowance but alert on any shell/interpreter child. Schedule every 15 minutes over the last 20 minutes.

• 🔒 ImageMagick Arbitrary File Write Outside Temp Directories (Active Storage MSL Coder Abuse) · unlock with TL Creds
• 🔒 Rails Secret and Credential File Access via Shell Utilities (master.key, credentials.yml.enc, environ) · unlock with TL Creds
• 🔒 Rails App Server Spawns Reverse Shell or Download Cradle (Post-Exfiltration RCE) · unlock with TL Creds
• 🔒 Active Storage Upload Endpoint Probed by Non-Browser Client (Exploitation Attempt Surface) · unlock with TL Creds
• 🔒 Ruby Process Handling secret_key_base or Signed-Cookie Primitives (Session Forgery Preparation) · unlock with TL Creds
• 🔒 Rails Process Launches Cloud or Database Client with Harvested Credentials (Lateral Movement) · unlock with TL Creds
• 🔒 Rails Secret Material Read by ImageMagick or Non-Ruby Process (secret_key_base / credentials.yml.enc) · unlock with TL Creds
• 🔒 ImageMagick or Ghostscript Outbound Network Connection from Rails Host (Remote Coder / Delegate Fetch) · unlock with TL Creds

Indicators of compromise for TL-2026-5254

As of 2026-11-04, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-5254.

How Critical Ruby on Rails Active Storage Flaw works

GitHub Security Advisory GHSA-f3w6-w445-fwh9, published 2026-11-04, describes a critical (CVSS 9.8, vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) weakness in Rails Active Storage image processing. No CVE ID has been assigned as of publication. The advisory classifies the weakness as CWE-1188 (Initialization of a Resource with an Insecure Default). Affected: activestorage before 8.0.5.2 and 8.1 releases before 8.1.4.1. Fixed in activestorage 8.0.5.2 and 8.1.4.1; the source also states mini_magick 5.1 or newer is required.

Root cause: ImageMagick selects a coder (file-format handler) based on the contents of a file, not on its name or extension. Several coders can perform operations on other files referenced from within the image. Active Storage did not restrict dangerous coders, and its image analyzer runs as soon as a file is attached, so no additional variant, preview or analyze call by the application is needed to trigger the behavior. A crafted upload can therefore make ImageMagick write files to the server; when the Disk service is used, the same upload can also cause files to be read from the server.

Exploitation requires all of: (1) config.active_storage.variant_processor = :mini_magick (the default for load_defaults 6.1 or earlier); (2) ImageMagick running under a permissive security policy (Debian/Ubuntu defaults lack the protections); (3) an application that accepts untrusted user uploads. Files at risk typically include secret_key_base, the contents of config/credentials.yml.enc, storage and database credentials, and third-party API tokens. Per the source, disclosure of such material can enable remote code execution or lateral movement to connected services.

The patch ships an ImageMagick security policy that blocks the MSL scripting coder, file deletion/read coders, remote/local reference fetchers, Ghostscript-backed coders and @filename indirection. The reporter is ryotak (Ry0taK), via HackerOne.

The advisory is separate from CVE-2026-66066, a libvips-based Active Storage arbitrary file read/RCE flaw (Rails advisory 2026-07-29; fixed in 7.2.3.2, 8.0.5.1, 8.1.3.1), for which public PoCs appeared ahead of the planned 2026-08-28 disclosure and an Akamai-named 'KindaRails2Shell' chain (file read, secret_key_base theft, session cookie forgery, RCE) was reported. The advisory text cited by the source lists that related flaw as exploited in the wild. For the present flaw the source states no CVE, public PoC, IOCs, or confirmed in-the-wild exploitation; ACTIVE status reflects an unpatched critical exposure, not confirmed exploitation.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1036.008 Masquerading; T1078 Valid Accounts; T1550.004 Use Alternate Authentication Material

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1552.001 Unsecured Credentials; T1606.001 Forge Web Credentials

Remediation for Critical Ruby on Rails Active Storage Flaw

Patches

• activestorage 8.0.5.2
• activestorage 8.1.4.1
• mini_magick 5.1 or newer

Immediate actions

• Upgrade activestorage to 8.0.5.2 or 8.1.4.1 (and mini_magick 5.1 or newer)
• Apply the ImageMagick security policy shipped with the fix
• Restrict or disable untrusted image uploads until patched
• Review upload logs for suspicious activity

Workarounds

• Copy the security policy rules into /etc/ImageMagick-7/policy.xml denying the MSL coder, Ghostscript-backed coders (PS, PDF, EPS variants) and the gs delegate
• Rotate secret_key_base and every secret accessible to the application process after patching, especially when the Disk service is used

Longer-term hardening

• Remove unnecessary file permissions from the application process so a file read/write exposes less
• Keep ImageMagick under a restrictive policy.xml denying dangerous coders
• Audit application file permissions and secret exposure to the Rails process

Affected and fixed versions

• Ruby on Rails — Active Storage (activestorage)
  Vulnerable versions: < 8.0.5.2; >= 8.1, < 8.1.4.1
  Fixed in: 8.0.5.2; 8.1.4.1
• mini_magick — mini_magick
  Vulnerable versions: earlier than 5.1 (per source: 5.1 or newer required)
  Fixed in: 5.1 or newer

Timeline of Critical Ruby on Rails Active Storage Flaw

• 2026-07-29 Rails publishes advisory for the related libvips-based Active Storage flaw CVE-2026-66066 (fixed in 7.2.3.2, 8.0.5.1, 8.1.3.1).
• 2026-07-31 Attack details and forensic tooling (locked-ioc-1) for CVE-2026-66066 released after public PoCs appeared ahead of the planned disclosure.
• 2026-08-01 BleepingComputer reports the CVE-2026-66066 patch, noting disclosure planned for 2026-08-28 was accelerated by PoC availability and describing the Akamai 'KindaRails2Shell' chain.
• 2026-08-02 GridinSoft analysis of CVE-2026-66066 updated, advising secret rotation and invalidation of sessions and signed artifacts.
• 2026-11-04 Cyber Security News reports the flaw, credited to researcher ryotak via HackerOne; no PoC or in-the-wild exploitation stated for this flaw.
• 2026-11-04 Fixed releases locked-ioc-5 8.0.5.2 and 8.1.4.1 made available; locked-ioc-6 5.1 or newer required; patch ships a restrictive locked-ioc-7 policy.
• 2026-11-04 GitHub Security Advisory GHSA-f3w6-w445-fwh9 published for the locked-ioc-7/locked-ioc-6 Active Storage flaw (CVSS 9.8, no CVE assigned).

Sources cited for Critical Ruby on Rails Active Storage Flaw

• GHSA-f3w6-w445-fwh9 - Rails Active Storage advisory GitHub · Advisory · 2026-11-04
• Active Storage arbitrary file read and RCE in variant processing - CVE-2026-66066 (related) corgea.com · Advisory · 2026-07-29
• oss-security: Rails Active Storage advisory (related, CVE-2026-66066) openwall.com · Advisory · 2026-07-29
• Rails CVE-2026-66066: Patch Active Storage and Rotate Secrets (related) blog.gridinsoft.com · Blog · 2026-07-31
• Critical Ruby on Rails Flaw Could Let Hackers Steal Server Secrets Through Malicious Image Uploads cybersecuritynews.com · News · 2026-11-04
• Rails patches critical Active Storage flaw with RCE potential (CVE-2026-66066, related) BleepingComputer · News · 2026-08-01

More in vulnerability

• Debian and Ubuntu APT Flaw (CVE-2026-109518) Lets MitM Attackers Swap Verified Packages and Run Code as Root
• Increased Scanning for Vulnerable Legacy E-Mail Test Scripts (formail/mailtest.php variants, CVE-2000-0411 lineage)
• Critical Rails Active Storage Flaw (GHSA-f3w6-w445-fwh9) Lets Attackers Write Server Files via Crafted ImageMagick Uploads
• Google Chrome 157 Security Update Fixes 213 Bugs Including 7 Critical Vulnerabilities (CVE-2026-121156, CVE-2026-121247, CVE-2026-121229, CVE-2026-121246, CVE-2026-121035, CVE-2026-121203, CVE-2026-121126)
• rsync CPU Exhaustion via Algorithmic Complexity in hash_search() (CVE-2026-119741) - Fixed in 3.5.2