Ruby on Rails Active Storage ImageMagick Flaw Allows Server File Access

The activestorage gem before 8.1.4.1 for Ruby on Rails contains a vulnerability in ImageMagick attachment processing that can allow server read and write operations, such as reading secret_key_base.

The flaw occurs because the ImageMagick analyzer runs when a file is attached, and there is no ImageMagick security policy in place to block unintended functionality.

• Affected version: activestorage gem before 8.1.4.1 for Ruby on Rails.
• Precondition: ImageMagick attachment processing is used.
• Impact: attackers may read or write server files, potentially exposing secret_key_base.