A critical flaw in Ruby on Rails could allow an unauthenticated attacker to write arbitrary files on an app's server by uploading a crafted file if the app processes uploads using ImageMagick. The Rails project disclosed the flaw in an advisory and fixed it in versions 8.1.4.1 and 8.0.5.2. The flaw is in Active Storage, the part of Rails that handles file uploads.
Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads
About this summary. This is a short excerpt from the description that The Hacker News published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://thehackernews.com/2026/11/critical-rails-flaw-lets-attackers.html
Source attribution: headline and facts are from The Hacker News (thehackernews.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
CVE-2026-103866: Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling
Posted by Joerg Hoh on Nov 05 Severity: low Affected versions: - Apache Sling Engine before 3.0.4 Description: Inconsistent interpretation of HTTP requests ('HTTP…
CVE-2026-103863: Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths
Posted by Joerg Hoh on Nov 05 Severity: low Affected versions: - Apache Sling Engine before 3.0.4 Description: Improper neutralization of input during web page…
OpenBSD security advisory (AV26-1130)
Serial number: AV26-1130 Date: November 5, 2026 As of November 5, 2026, OpenBSD is affected by a vulnerability in the following product: OpenSSH Prior to 10.6p2 The…
OpenSSH flaw lets attackers log into password-disabled Linux accounts
A newly disclosed OpenSSH vulnerability dubbed "*sshole" allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts that are configured to…
OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux
Attackers can log in to accounts that have no password, such as SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package. They…
Rubyonrails security advisory (AV26-1129)
Serial number: AV26-1129 Date: November 5, 2026 As of November 4, 2026, Rubyonrails is affected by a vulnerability in the following product: Active Storage Prior to…