Free Certified Patch for Critical Rails Active Storage Vulnerability

Ruby on Rails released security updates on November 4, 2026, addressing 21 vulnerabilities including a critical Active Storage flaw tracked as GHSA-f3w6-w445-fwh9 (CVSS 9.8). The vulnerability allows unauthenticated attackers to write arbitrary files to servers via crafted uploads when ImageMagick is used through the mini_magick variant processor. Exploitation can also lead to sensitive file reads and potentially remote code execution, including exposure of secret_key_base and application credentials. Affected versions include Rails 8.0.x and 8.1.x; patched releases are 8.0.5.2 and 8.1.4.1. MiniMagick must also be updated to version 5.1 or later. Socket has released a free Certified Patch for the critical vulnerability as an interim remediation for teams unable to upgrade immediately. Developers are advised to upgrade Rails, verify MiniMagick compatibility, review Active Storage configurations, and rotate potentially exposed credentials.