What Happened
Rails disclosed a critical Active Storage flaw, tracked as GHSA-f3w6-w445-fwh9 with no CVE yet, The Hacker News reports. It carries a CVSS score of 9.8. An unauthenticated attacker uploads a specially built SVG file and writes arbitrary files on the server. The analyzer runs when a file is attached, so no variant or preview call is needed. Apps on the Disk service also expose any file the app reads, including secret_key_base and third-party credentials.
Three conditions must hold. The app uses ImageMagick through mini_magick, the ImageMagick policy does not block the involved coders, and the app accepts uploads from untrusted users. Rails says the default Debian and Ubuntu policies do not block them. RyotaK of GMO Flatt Security reported the flaw. Fixes ship in 8.1.4.1 and 8.0.5.2.
Why This Matters for Canadian Organizations
Canadian startups, SaaS vendors, e-commerce shops, and public sector portals run Rails, and many accept profile photos or document uploads. Stolen secrets lead to session forgery, database access, and lateral movement into cloud accounts. For firms holding personal information, this path ends in a PIPEDA breach assessment. Federally regulated financial firms face OSFI expectations on third-party and application risk.
Timing adds pressure. Rails 8.0 receives security fixes only until November 7. Teams on older releases get no fixes and must move or apply a workaround.
What to Do
Upgrade to 8.1.4.1 or 8.0.5.2 and use mini_magick 5.1 or later. Confirm the new policy loads with the identify command from the Rails advisory. Check for overrides of MiniMagick.cli_env or a custom shell, which disable the shipped policy. If you cannot upgrade today, copy the Rails policy rules into the system ImageMagick policy and block the MSL coder, the Ghostscript coders, and the gs delegate. Rotate secret_key_base and every secret the app process reads if you run the Disk service. Review upload logs for unusual SVG files. See more TechTalk coverage and our latest news.
