CERT24Critical Rails Active Storage vulnerability has potential for RCELoading data…
CERT24Threat Observatory
Period

Critical Rails Active Storage vulnerability has potential for RCE

A critical vulnerability in the Rails Active Storage framework may allow an unauthenticated attacker to read arbitrary files from a Rails application and potentially achieve remote code execution (RCE). The attack is possible when libvips is used and the application allows untrusted users to upload images.

← Back to intelligence

Critical Rails Active Storage vulnerability has potential for RCE

A critical vulnerability in the Rails Active Storage framework may allow an unauthenticated attacker to read arbitrary files from a Rails application and potentially achieve remote code execution (RCE). The attack is possible when libvips is used and the application allows untrusted users to upload images.