---
title: Security Update Released for Ruby on Rails
url: https://www.dataloco.com/en/security-update-released-for-ruby-on-rails
published: 2026-11-07T16:20:52+00:00
language: en
section: Security
source: https://www.security-next.com/192381
organizations: rails, ruby
publisher: Dataloco
---

# Security Update Released for Ruby on Rails

A security update has been released for the web application framework Ruby on Rails, addressing multiple vulnerabilities. This includes a critical vulnerability that was identified.

On November 4, 2026, the development team released security updates for Ruby on Rails versions 8.1.4.1 and 8.0.5.2. A total of 21 security issues have been fixed, including one categorized as 'Critical', four as 'High', thirteen as 'Medium', and three as 'Low'.

The vulnerability classified as 'Critical' pertains to the image parsing process of Active Storage, which handles file uploads and management. This vulnerability is identified as CVE-2026-122006, with a base score of 9.8 according to the Common Vulnerability Scoring System CVSSv3.1.

Applications using ImageMagick for image processing and allowing file uploads from untrusted users are affected. There is a risk that a crafted file could lead to arbitrary file writes on the server, and under certain conditions, there is potential for files to be stolen from the application.

Additionally, the update addresses a wide range of vulnerabilities, including risks of arbitrary file reading, remote code execution, bypassing parameter validation, IP address spoofing, cross-site scripting (XSS), and denial of service (DoS).

The development team strongly recommends users to promptly update to the patched versions. Notably, security support for the 8.0 branch will end on November 7, 2026, meaning that no further vulnerability fixes will be provided, which requires attention from users.

## This story in other languages

- [Español](https://www.dataloco.com/es/actualizacion-de-ruby-on-rails-corrige-21-vulnerabilidades)
- [Italiano](https://www.dataloco.com/it/ruby-on-rails-corregge-21-vulnerabilita-una-critica-in-active-storage)
- [Svenska](https://www.dataloco.com/sv/ruby-on-rails-uppdateras-for-att-atgarda-21-sarbarheter)
- [Norsk](https://www.dataloco.com/no/ruby-on-rails-har-rettet-21-sarbarheter-i-nye-oppdateringer)
- [Polski](https://www.dataloco.com/pl/ruby-on-rails-usuwa-21-lukow-bezpieczenstwa-w-tym-jeden-krytyczny)
- [Русский](https://www.dataloco.com/ru/obnovlenie-ruby-on-rails-ispravleno-21-uiazvimost)
- [Deutsch](https://www.dataloco.com/de/update-fur-ruby-on-rails-21-sicherheitsanfalligkeiten-behoben)
- [Português (Brasil)](https://www.dataloco.com/pt-br/atualizacao-do-ruby-on-rails-corrige-21-vulnerabilidades)
- [עברית](https://www.dataloco.com/he/ruby-on-rails-21)
- [Nederlands](https://www.dataloco.com/nl/ruby-on-rails-ontvangt-belangrijke-beveiligingsupdate)