Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads

A critical vulnerability has been discovered in Ruby on Rails that allows unauthorized attackers to write arbitrary files to a server. This can be achieved by uploading a specially crafted file that exploits the flaw when processed using ImageMagick. The issue is specifically located in Active Storage, which is the component of Rails responsible for handling file uploads. The Rails project has released an advisory about the flaw and has issued fixes in versions 8.1.4.1 and 8.0.5.2. The vulnerability can be exploited without authentication, making it a significant security concern. Some applications that store files using Active Storage may be affected by this flaw.