Possible arbitrary file read and remote code execution in Active Storage variant processing · Advisory · rails/rails · GitHub

//repos/advisories/show" data-turbo-transient="true" />

Skip to content

Search or jump to...

Search code, repositories, users, issues, pull requests...

-->

Search

Clear

Search syntax tips

Provide feedback

--><br>We read every piece of feedback, and take your input very seriously.

Include my email address so I can be contacted

Cancel

Submit feedback

Saved searches

Use saved searches to filter your results more quickly

-->

Name

Query

To see all available qualifiers, see our documentation.

Cancel

Create saved search

Sign in

//repos/advisories/show;ref_cta:Sign up;ref_loc:header logged out"}"<br>Sign up

Appearance settings

Resetting focus

You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

{{ message }}

Uh oh!

There was an error while loading. Please reload this page.

rails

rails

Public

Notifications<br>You must be signed in to change notification settings

Fork<br>22.3k

Star<br>58.7k

Possible arbitrary file read and remote code execution in Active Storage variant processing

Critical

byroot<br>published<br>GHSA-xr9x-r78c-5hrm<br>Jul 29, 2026

Package

bundler

activestorage<br>(RubyGems)

Affected versions

>= 8.0, >= 8.1,<br>Patched versions

7.2.3.2

8.0.5.1

8.1.3.1

Description

Impact

In its default configuration, a Rails application that displays image variants may allow an

unauthenticated attacker to read arbitrary files from the server, including the process environment.

That environment typically holds secret_key_base and often credentials for external systems, which

may in turn allow escalation to remote code execution or lateral movement to those systems.

Details

libvips reads and writes file formats through "loaders" and "savers" (or more generally

"operations"), many of which are backed by third-party libraries. It marks some of these operations

as "unfuzzed", meaning they are unsafe for untrusted content, and several handle formats unrelated

to web images. Active Storage did not disable the unfuzzed operations, so an attacker who can upload

a crafted file and cause a variant to be generated from it may be able to invoke one.

We are aware of a mechanism by which an attacker, by uploading a crafted file, is able to cause

disclosure of the contents of arbitrary files accessible on the filesystem of the targeted

application. One specific attack chain has been reported to us (see "Disclosure" below), but we do

not assume it is the only one that exists.

Affected applications

An application is affected if it meets all of these requirements:

Uses libvips for Active Storage image processing. This is config.active_storage.variant_processor = :vips,

which load_defaults 7.0 set and no later default has changed.

Allows image uploads from untrusted users.

Generating variants is not a separate requirement.

Mitigation

Upgrade to a fixed version of activestorage.

The minimum version of libvips must be upgraded to >= 8.13.

Change secret_key_base and change any secrets accessible in the application environment (see "Expire and change secrets" below)

Earlier versions of libvips () cannot disable unfuzzed operations at all, and Active Storage

will raise an exception during boot in such an unsecurable environment.

Expire and change secrets

Upgrading closes the vulnerability but does not undo an exfiltrated secret if that already

occurred. An affected application should treat every secret readable by the application process as

potentially exposed and change it, including:

secret_key_base

The master key, whether stored in config/master.key or supplied as RAILS_MASTER_KEY, along

with everything in config/credentials.yml.enc that it decrypts

Credentials for the Active Storage service, such as S3, GCS, or Azure keys

Database credentials

Tokens and keys for any third-party service the application calls

Changing secret_key_base expires active sessions and requires users to log in again. Encrypted

cookies, signed cookies, signed global IDs, and Active Storage URLs are also affected.

Rotation should only be used as an intermediate step if necessary. Do not retain an exposed secret

as a fallback.

Workarounds

If libvips is being used, there are no workarounds available other than removing the

dependency on libvips from the application. Some applications may have ruby-vips declared as a

dependency only for image analysis, and those applications may be able to simply remove ruby-vips

from the Gemfile to remove libvips from the application. Applications that do not use Active Storage

can remove ruby-vips from the Gemfile to avoid the boot-time checks.

If libvips >= 8.13 is present on the system, applications can disable the unfuzzed operations

without upgrading Rails...