# CVE-2025-24293: Ruby on Rails Active Storage command injection in image transformations

Source: https://junglewise.ai/threats/cve-2025-24293-ruby-on-rails-active-storage-command-injection-in-image  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2025-24293 · Severity: high · CVSS 8.1 · Published 2026-01-30

A vulnerability in Ruby on Rails' Active Storage component could allow an attacker to execute unauthorized commands on a web server. This occurs when an application allows users to provide their own settings for image resizing or processing. If exploited, an attacker could gain full control over the server, potentially leading to data theft or service disruption.

Technologies: [Ruby on Rails Active Storage](https://junglewise.ai/threats/technologies/active-storage), [activestorage (RubyGems)](https://junglewise.ai/threats/technologies/activestorage). Vendors: [Ruby on Rails](https://junglewise.ai/threats/vendors/ruby-on-rails), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2025-24293 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-24293 being exploited in the wild.

**How severe is CVE-2025-24293?** High severity, with a CVSS score of 8.1, published 30 January 2026.

**Which products and versions are affected?** activestorage (RubyGems) ECOSYSTEM:introduced=8.0,fixed=8.0.2.1.

**Is there a fix for CVE-2025-24293?** Yes. activestorage (RubyGems): upgrade to 8.0.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-24293 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-24293?** Check whether you run Ruby on Rails Active Storage or activestorage (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- activestorage (RubyGems): upgrade to 8.0.2.1 or later

  ```sh
  bundle update activestorage
  ```


## Technical details

A command injection vulnerability exists in Active Storage's image transformation logic. The root cause is an insufficient allow-list of transformation methods that permits the circumvention of safe defaults when using the 'image_processing' gem with 'mini_magick'. An attacker can exploit this by providing malicious transformation methods or arguments via web parameters (e.g., in a URL) if the application passes these directly to the 'variant' method. This can lead to arbitrary shell command execution on the underlying host. Patches are available in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.

## Affected products

- Rails activestorage >= 5.2.0, < 7.1.5.2
- Rails activestorage >= 7.2, < 7.2.2.2
- Rails activestorage >= 8.0, < 8.0.2.1

## Identifiers

- CVE-2025-24293
- GHSA-r4mg-4433-c7g3

## Timeline

- 2025-08-13: disclosed: Initial disclosure in rails/rails repository
- 2026-01-30: advisory: NVD and Red Hat advisories published
- 2026-01-31: patched: Patched versions confirmed in GitHub Advisory Database

## References

- [https://access.redhat.com/security/cve/CVE-2025-24293](https://access.redhat.com/security/cve/CVE-2025-24293)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2435565](https://bugzilla.redhat.com/show_bug.cgi?id=2435565)
- [https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-24293.json](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-24293.json)

## Related threats

- [Active Storage: Possible local file disclosure in video previews and analysis](https://junglewise.ai/threats/cve-2026-126188-active-storage-makes-it-simple-to-upload-and-reference-files-in)
- [Ruby on Rails Active Storage arbitrary file read and RCE in media processing](https://junglewise.ai/threats/cve-2026-126186-active-storage-possible-arbitrary-file-read-and-remote-code)
- [Ruby on Rails Active Storage content length bypass in Google Cloud Storage uploads](https://junglewise.ai/threats/cve-2026-126085-active-storage-possible-circumvention-of-file-size-limits-in)
- [Ruby on Rails Active Storage GCS signature bypass](https://junglewise.ai/threats/cve-2026-126084-active-storage-makes-it-simple-to-upload-and-reference-files-in)
- [Rails Active Storage persistent DoS via NUL byte filename](https://junglewise.ai/threats/cve-2026-126074-active-storage-makes-it-simple-to-upload-and-reference-files-in)