Executive brief
A vulnerability in Ruby on Rails' Active Storage component could allow an attacker to execute unauthorized commands on a web server. This occurs when an application allows users to provide their own settings for image resizing or processing. If exploited, an attacker could gain full control over the server, potentially leading to data theft or service disruption.
Technical details
A command injection vulnerability exists in Active Storage's image transformation logic. The root cause is an insufficient allow-list of transformation methods that permits the circumvention of safe defaults when using the 'image_processing' gem with 'mini_magick'. An attacker can exploit this by providing malicious transformation methods or arguments via web parameters (e.g., in a URL) if the application passes these directly to the 'variant' method. This can lead to arbitrary shell command execution on the underlying host. Patches are available in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.
Affected products
- Rails activestorage >= 5.2.0, < 7.1.5.2
- Rails activestorage >= 7.2, < 7.2.2.2
- Rails activestorage >= 8.0, < 8.0.2.1
Timeline
- 2025-08-13: disclosed: Initial disclosure in rails/rails repository
- 2026-01-30: advisory: NVD and Red Hat advisories published
- 2026-01-31: patched: Patched versions confirmed in GitHub Advisory Database