CVE-2025-24293: Ruby on Rails Active Storage command injection in image transformations

CVE-2025-24293 · Severity: high · CVSS 8.1 · Published 2026-01-30

A vulnerability in Ruby on Rails' Active Storage component could allow an attacker to execute unauthorized commands on a web server. This occurs when an application allows users to provide their own settings for image resizing or processing. If exploited, an attacker could gain full control over the server, potentially leading to data theft or service disruption.

Technologies: Ruby on Rails Active Storage, activestorage (RubyGems). Vendors: Ruby on Rails, RubyGems.

Quick answers

Is CVE-2025-24293 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-24293 being exploited in the wild.
How severe is CVE-2025-24293?
High severity, with a CVSS score of 8.1, published 30 January 2026.
Which products and versions are affected?
activestorage (RubyGems) ECOSYSTEM:introduced=8.0,fixed=8.0.2.1.
Is there a fix for CVE-2025-24293?
Yes. activestorage (RubyGems): upgrade to 8.0.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-24293 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-24293?
Check whether you run Ruby on Rails Active Storage or activestorage (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • activestorage (RubyGems): upgrade to 8.0.2.1 or later
    bundle update activestorage

Technical details

A command injection vulnerability exists in Active Storage's image transformation logic. The root cause is an insufficient allow-list of transformation methods that permits the circumvention of safe defaults when using the 'image_processing' gem with 'mini_magick'. An attacker can exploit this by providing malicious transformation methods or arguments via web parameters (e.g., in a URL) if the application passes these directly to the 'variant' method. This can lead to arbitrary shell command execution on the underlying host. Patches are available in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.

Affected products

  • Rails activestorage >= 5.2.0, < 7.1.5.2
  • Rails activestorage >= 7.2, < 7.2.2.2
  • Rails activestorage >= 8.0, < 8.0.2.1

Identifiers

  • CVE-2025-24293
  • GHSA-r4mg-4433-c7g3

Timeline

  • 2025-08-13: disclosed: Initial disclosure in rails/rails repository
  • 2026-01-30: advisory: NVD and Red Hat advisories published
  • 2026-01-31: patched: Patched versions confirmed in GitHub Advisory Database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.