# Critical Ruby on Rails Active Storage Flaw (GHSA-f3w6-w445-fwh9) Allows Server Secret Theft via Malicious Image Uploads to ImageMagick (CVE not yet assigned)

> A critical flaw in Ruby on Rails Active Storage lets unauthenticated users upload crafted images that cause ImageMagick (via mini_magick) to write files to the server, and with the Disk service to read server files. At-risk data typically includes secret_key_base and credentials for external systems, potentially enabling remote code execution or lateral movement.

- **Published:** 2026-11-04T18:08:31Z
- **Last reviewed:** 2026-11-04T18:08:31Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5254
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5254.png
- **ID:** TL-2026-5254
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 7
- **CVEs:** CVE-2026-66066

## Description

GitHub Security Advisory GHSA-f3w6-w445-fwh9, published 2026-11-04, describes a critical (CVSS 9.8, vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) weakness in Rails Active Storage image processing. No CVE ID has been assigned as of publication. The advisory classifies the weakness as CWE-1188 (Initialization of a Resource with an Insecure Default). Affected: activestorage before 8.0.5.2 and 8.1 releases before 8.1.4.1. Fixed in activestorage 8.0.5.2 and 8.1.4.1; the source also states mini_magick 5.1 or newer is required.

Root cause: ImageMagick selects a coder (file-format handler) based on the contents of a file, not on its name or extension. Several coders can perform operations on other files referenced from within the image. Active Storage did not restrict dangerous coders, and its image analyzer runs as soon as a file is attached, so no additional variant, preview or analyze call by the application is needed to trigger the behavior. A crafted upload can therefore make ImageMagick write files to the server; when the Disk service is used, the same upload can also cause files to be read from the server.

Exploitation requires all of: (1) config.active_storage.variant_processor = :mini_magick (the default for load_defaults 6.1 or earlier); (2) ImageMagick running under a permissive security policy (Debian/Ubuntu defaults lack the protections); (3) an application that accepts untrusted user uploads. Files at risk typically include secret_key_base, the contents of config/credentials.yml.enc, storage and database credentials, and third-party API tokens. Per the source, disclosure of such material can enable remote code execution or lateral movement to connected services.

The patch ships an ImageMagick security policy that blocks the MSL scripting coder, file deletion/read coders, remote/local reference fetchers, Ghostscript-backed coders and @filename indirection. The reporter is ryotak (Ry0taK), via HackerOne.

The advisory is separate from CVE-2026-66066, a libvips-based Active Storage arbitrary file read/RCE flaw (Rails advisory 2026-07-29; fixed in 7.2.3.2, 8.0.5.1, 8.1.3.1), for which public PoCs appeared ahead of the planned 2026-08-28 disclosure and an Akamai-named 'KindaRails2Shell' chain (file read, secret_key_base theft, session cookie forgery, RCE) was reported. The advisory text cited by the source lists that related flaw as exploited in the wild. For the present flaw the source states no CVE, public PoC, IOCs, or confirmed in-the-wild exploitation; ACTIVE status reflects an unpatched critical exposure, not confirmed exploitation.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1036.008 Masquerade File Type
- T1552.001 Credentials In Files
- T1606.001 Web Cookies
- T1550.004 Web Session Cookie
- T1005 Data from Local System
- T1078 Valid Accounts

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Active Storage ImageMagick Coder Abuse - Ghostscript or Shell Spawned by ImageMagick (GHSA-f3w6-w445-fwh9)** (`TL-2026-5254-SPL-001`)

TL-2026-5254 / GHSA-f3w6-w445-fwh9: a crafted upload makes ImageMagick (via mini_magick, invoked by Rails activestorage on attach) select a dangerous coder or delegate based on file content. Because the coder is chosen from content, the payload is not visible in the command line; the reliable signal is process behaviour. ImageMagick binaries (magick, convert, identify, mogrify) should only spawn Ghostscript with -dSAFER and should never spawn shells, interpreters or downloaders. This rule flags the gs delegate running without -dSAFER (or with -dNOSAFER / %pipe%) and any non-gs child of ImageMagick. Behaviour-based from advisory mechanics; no public PoC or in-the-wild exploitation is reported for this flaw.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059, T1036.008
- **Data sources:** splunk_cim_endpoint_processes, sysmon_for_linux, linux_auditd_execve
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("magick","convert","convert-im6.q16","identify","mogrify","magick-im6.q16") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process
| rename "Processes.*" as *
```Ghostscript delegate is only expected with -dSAFER; shells and downloaders are never expected under ImageMagick```
| where NOT (process_name="gs" AND match(process,"-dSAFER") AND NOT match(process,"(-dNOSAFER|%pipe%)"))
| convert ctime(firstTime) ctime(lastTime)
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("magick","convert","convert-im6.q16","identify","mogrify","magick-im6.q16")
| where FileName !~ "gs" or ProcessCommandLine !contains "-dSAFER" or ProcessCommandLine has_any ("-dNOSAFER","%pipe%")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, FileName, ProcessCommandLine
```

### Sigma

```yaml
title: Rails Active Storage ImageMagick Spawns Ghostscript Without SAFER or Shell Child (GHSA-f3w6-w445-fwh9)
id: 3d0b6f1e-8a52-4c7e-b1f4-6a9e2c5d7101
status: experimental
description: Detects ImageMagick binaries spawning shells, interpreters or downloaders, or the Ghostscript delegate running without -dSAFER or with -dNOSAFER/%pipe%, consistent with coder abuse via crafted Active Storage uploads (TL-2026-5254, GHSA-f3w6-w445-fwh9).
references:
  - https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/04
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059
  - attack.defense-evasion
  - attack.t1036.008
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/magick'
      - '/convert'
      - '/convert-im6.q16'
      - '/identify'
      - '/mogrify'
      - '/magick-im6.q16'
  sub_shell:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/python3'
      - '/perl'
      - '/ruby'
  sub_gs_unsafe:
    Image|endswith: '/gs'
    CommandLine|contains:
      - '-dNOSAFER'
      - '%pipe%'
  sub_gs:
    Image|endswith: '/gs'
  filter_safe:
    CommandLine|contains: '-dSAFER'
  condition: selection_parent and (sub_shell or sub_gs_unsafe or (sub_gs and not filter_safe))
falsepositives:
  - Image pipelines that intentionally shell out from ImageMagick delegates
  - Legitimate PDF/PS preview generation through the gs delegate
level: high

```

**Known false positives:**

- Applications that legitimately render PDF/PS/EPS previews through ImageMagick and its gs delegate
- Custom ImageMagick delegates configured in delegates.xml that invoke helper scripts

**Tuning notes:** Populate the Endpoint.Processes data model from Sysmon for Linux or auditd execve (and map process_name/parent_process_name). Add ImageMagick binary names used by your distro (e.g. magick-im6.q16). If the app legitimately renders PDFs, keep the gs -dSAFER allowance but alert on any shell/interpreter child. Schedule every 15 minutes over the last 20 minutes.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ImageMagick Arbitrary File Write Outside Temp Directories (Active Storage MSL Coder Abuse) (locked: unlock with TL Creds)
- Rails Secret and Credential File Access via Shell Utilities (master.key, credentials.yml.enc, environ) (locked: unlock with TL Creds)
- Rails App Server Spawns Reverse Shell or Download Cradle (Post-Exfiltration RCE) (locked: unlock with TL Creds)
- Active Storage Upload Endpoint Probed by Non-Browser Client (Exploitation Attempt Surface) (locked: unlock with TL Creds)
- Ruby Process Handling secret_key_base or Signed-Cookie Primitives (Session Forgery Preparation) (locked: unlock with TL Creds)
- Rails Process Launches Cloud or Database Client with Harvested Credentials (Lateral Movement) (locked: unlock with TL Creds)
- Rails Secret Material Read by ImageMagick or Non-Ruby Process (secret_key_base / credentials.yml.enc) (locked: unlock with TL Creds)
- ImageMagick or Ghostscript Outbound Network Connection from Rails Host (Remote Coder / Delegate Fetch) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Critical Ruby on Rails Flaw Could Let Hackers Steal Server Secrets Through Malicious Image Uploads](https://cybersecuritynews.com/critical-ruby-on-rails-flaw/)
- [GHSA-f3w6-w445-fwh9 - Rails Active Storage advisory](https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9)
- [Rails patches critical Active Storage flaw with RCE potential (CVE-2026-66066, related)](https://www.bleepingcomputer.com/news/security/rails-patches-critical-active-storage-flaw-with-rce-potential/)
- [Rails CVE-2026-66066: Patch Active Storage and Rotate Secrets (related)](https://blog.gridinsoft.com/rails-active-storage-cve-2026-66066/)
- [Active Storage arbitrary file read and RCE in variant processing - CVE-2026-66066 (related)](https://corgea.com/advisories/vulnerabilities/CVE-2026-66066)
- [oss-security: Rails Active Storage advisory (related, CVE-2026-66066)](https://www.openwall.com/lists/oss-security/2026/07/29/9)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5254