Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads

A critical flaw in Ruby on Rails could let an unauthenticated attacker write arbitrary files on an application’s server by uploading a crafted file, if the app processes uploads using ImageMagick, The Hacker News reports. The flaw is in Active Storage, which handles file uploads, and is fixed in Rails 8.1.4.1 and 8.0.5.2.