Rails 8.0.5.2 and 8.1.4.1 fix 21 security issues, one critical in Active Storage image analysis
Serguey Asael Shinder1 min readThe Rails team has released Rails 8.0.5.2 and 8.1.4.1, security updates that address 21 issues. The one rated critical, GHSA-f3w6-w445-fwh9, is a possible arbitrary file write and read in Active Storage image analysis. A second Active Storage issue, rated high, allows possible arbitrary file read and remote code execution in video previews, analysis and image processing.
Three more issues are rated high: a possible Strong Parameters bypass in Parameters#each_key in Action Pack, possible IP spoofing in Action Dispatch RemoteIp through the Forwarded header (8.1 only), and a possible denial of service in Active Support safe_constantize. The medium-rated group includes four XSS issues in Action View text, highlight, strip_tags and tag helpers, one in the Active Support MessagePack serializer (8.1 only), DoS bugs in Action Controller Live streaming and in Active Storage proxy mode and filename handling, and unsigned Content-Type and unenforced file size limits in direct uploads to Google Cloud Storage.
Session handling appears several times: a destroyed session could be restored by the CacheStore, Active Storage proxy mode could leak session information, and session stores did not set the SameSite attribute on their cookies. The list also includes cache poisoning through content negotiation and signature replay in Action Mailbox Mailgun ingress.
The team strongly recommends upgrading as soon as possible. Older versions are unsupported, and security support for the 8.0 series ends on 7 November 2026, three days after this release. Each advisory links to patches for teams that cannot upgrade immediately.
What it means
Apps that process user uploads with Active Storage should treat this as an emergency update. Teams still on 8.0 have a second deadline inside the same week: after 7 November the next fix will only come for 8.1.