The Ruby on Rails project published an advisory on a critical (CVSS 9.8) flaw in Active Storage, the component that handles file uploads. According to the advisory, in apps that process uploads with ImageMagick, an unauthenticated attacker can write arbitrary files to the server by uploading a crafted file. In apps that store files on the server's disk (the Disk service), the attacker can also read any file the app can read.
According to Rails, those files typically include the app's secret_key_base and its credentials for other systems, and exposing them can lead to remote code execution or lateral movement. Attaching the uploaded file is enough to reach the flaw. It has no CVE identifier yet (it is tracked as GHSA-f3w6-w445-fwh9), and the advisory does not say whether it has been exploited. It was reported by researcher RyotaK of GMO Flatt Security.
What to do: update to 8.1.4.1 or 8.0.5.2. Every earlier Active Storage version is affected, and series older than 8.0 will get no fixes because they are no longer supported. To check whether an app uses ImageMagick, look at the config.active_storage.variant_processor setting. The same releases also fix a second, high-severity (8.8) Active Storage flaw.