The Active Storage gem, when using ImageMagick during file attachment processing, allows an attacker to perform read and write operations on the server. Prior to version 8.1.4.1, the ImageMagick analyzer executes without a security policy that restricts access, enabling an attacker to read sensitive files such as the application’s secret_key_base and modify them. This vulnerability is classified as CWE-1188 and can lead to serious confidentiality and integrity breaches.

Ruby on Rails Active Storage, versions prior to 8.1.4.1 (including releases < 8.1.4.1). The vulnerability is present in all deployments that rely on ImageMagick for attachment processing in these versions.

The vulnerability has a CVSS score of 9.8, indicating high severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. While the exploit requires upload of a crafted file that triggers the ImageMagick analyzer, it is likely that any public or internal endpoint that accepts file uploads can be abused. The exploit can be performed remotely via the application’s attachment handling pathway, making the attack vector likely web-based and client-initiated.