Security
Rails' critical Active Storage bug lets one image upload write files on your server: who's exposed and what to do
A CVSS 9.8 flaw in Rails' Active Storage, CVE-2026-122006, lets an unauthenticated upload reach ImageMagick's file-reading and file-writing coders. Rails 8.1.4.1 and 8.0.5.2 fix it along with 20 other security bugs, and Rails 8.0 stops getting security fixes on November 7.