Executive brief
Ruby on Rails applications using the Active Storage component for image processing are vulnerable to a critical security flaw. By uploading a specially crafted image file, an attacker can trick the server into reading sensitive files, such as environment variables and application secrets. This could lead to full system takeover, data theft, or unauthorized access to external services.
Technical details
A vulnerability exists in Rails Active Storage where it fails to disable libvips loaders and savers marked as 'unfuzzed' or 'untrusted'. When an application is configured to use libvips for image processing, an unauthenticated attacker can upload a malicious image that triggers these unsafe operations. This can be exploited to perform arbitrary file reads, exposing sensitive data like 'secret_key_base' or service tokens. Such exposure often leads to remote code execution (RCE). The fix involves calling 'Vips.block_untrusted(true)' during the boot process and requires libvips 8.13+ and ruby-vips 2.2.1+.
Affected products
- Ruby on Rails Rails (Active Storage) < 7.2.3.2, >= 8.0.0.beta1, < 8.0.5.1, >= 8.1.0.beta1, < 8.1.3.1
Timeline
- 2026-07-29: patched: Fixes committed to Rails repository
- 2026-07-30: disclosed: CVE published and advisory released
References
- https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1e
- https://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5
- https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a
- https://github.com/rails/rails/releases/tag/v7.2.3.2
- https://github.com/rails/rails/releases/tag/v8.0.5.1
- https://github.com/rails/rails/releases/tag/v8.1.3.1
- https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm