A critical vulnerability in Active Storage's image analysis using ImageMagick allows unauthenticated attackers to write arbitrary files on the server and read sensitive files when using the Disk service. This can expose secrets such as secret_key_base and credentials, potentially leading to remote code execution or lateral movement. The issue arises because ImageMagick's coders are not constrained, enabling crafted files to invoke dangerous coders. Fixed versions introduce a security policy restricting risky coders and delegates.