Rubyonrails security advisory (AV26-1129)

Serial number: AV26-1129
Date: November 5, 2026

As of November 4, 2026, Rubyonrails is affected by a vulnerability in the following product:

• Active Storage
  • Prior to 8.0.5.2
  • Prior to 8.1.4.1

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Release 8.0.5.2 · rails/rails
• Release 8.1.4.1 · rails/rails
• Possible arbitrary file write and read in Active Storage image analysis