Ruby on Rails 8.0.5.2 and 8.1.4.1 fix 21 security issues, including a Critical arbitrary file read/write in Active Storage image analysis and High-rated RCE, Strong Parameters bypass and IP spoofing flaws
The Rails team released Rails 8.0.5.2 and 8.1.4.1 on 4 November 2026 as security updates addressing 21 issues and strongly recommends upgrading as soon as possible. The fixes include a Critical possible arbitrary file write and read in Active Storage image analysis (GHSA-f3w6-w445-fwh9); High-rated possible arbitrary file read and remote code execution in Active Storage video previews, analysis and image processing (GHSA-v924-7rp8-4mxh), a possible Strong Parameters bypass in Parameters#each_key (GHSA-wm3x-v3qw-4jh3), possible IP spoofing in Action Dispatch RemoteIp through the Forwarded header (8.1 only, GHSA-2gff-2mmg-m73p) and a possible DoS in Active Support safe_constantize (GHSA-8474-xrp6-wh69); plus Medium-rated XSS in Action View helpers, DoS, Active Storage direct-upload, session-handling, cache-poisoning and Action Mailbox Mailgun signature-replay issues.
Rails says older versions are unsupported, users should be on at least the 8.0 series, and security support for 8.0 ends on 7 November 2026. (source: Ruby on Rails)
- Product
- Ruby on Rails (Active Storage, Action Pack, Action Dispatch, Action View, Active Support, Action Mailbox)
- Versions
- Fixed: 8.0.5.2 and 8.1.4.1. Older series unsupported; 8.0 security support ends 7 Nov 2026
- CVSS
- Critical (Rails rating, GHSA-f3w6-w445-fwh9); no CVSS score given in the release post
- Exploited in Australia?
- unknown
- Patch to
- Upgrade to Rails 8.1.4.1 (or 8.0.5.2, then plan the move to 8.1 before 8.0 support ends on 7 Nov 2026); prioritise apps that use Active Storage image or video processing.