Rails 8.0.5.2 and 8.1.4.1 came out today with fixes for 21 security issues: 1 critical, 4 high, 13 medium, and 3 low. If your app accepts file uploads and uses ImageMagick, start with the critical one, because attaching a crafted file is enough to trigger it.

If you're on 8.0, there's also a deadline. Security support for the 8.0 series ends on November 7, and the maintenance policy lists 8.1 as supported until October 10, 2027. This batch has no 7.2 release, and the announcement recommends moving to at least 8.0. Take the patch now and plan the move to 8.1.

The issues are identified by GHSA IDs (GitHub Security Advisory numbers). None of the 21 had a CVE ID (the usual public vulnerability number) when I wrote this.

The Five That Need a Closer Look

Critical: File Write and Read in Active Storage Image Analysis

GHSA-f3w6-w445-fwh9 (CVSS severity score: 9.8 out of 10). An unauthenticated attacker may be able to write arbitrary files on the server.…