Rails Patches Critical File Read via Image Upload

Ruby on Rails released a security update for a critical flaw in the Active Storage component that lets unauthenticated attackers read arbitrary files from the application server through crafted image upload requests. If your application accepts image uploads via Active Storage, patch immediately.

What changed

The vulnerability is in how Active Storage processes image transformation requests. An attacker with no credentials can send crafted requests that cause the Rails process to read files outside the intended upload path and return their contents.

The Hacker News reports that reachable files include config/master.key, config/credentials.yml.enc, .env, and the process environment itself — which means SECRET_KEY_BASE, database connection strings, and cloud storage credentials are all in scope depending on your configuration. A CVE has been assigned; the NVD entry was pending indexing at time of publication. The Hacker News cites a CVSS score of 9.5.

What to do

Update your Gemfile to the patched Rails release and redeploy. The Rails security advisory page lists affected version ranges and the corresponding fixes.

If an immediate upgrade isn’t possible:

• Disable Active Storage image transformations in your environment configuration
• Tighten file-system permissions on the Rails process user — least privilege limits what an attacker can actually reach
• Audit what secrets are readable by the Rails process and rotate anything that fits: secret_key_base, master key, database passwords, and any cloud service credentials stored in the environment or credentials file

Don’t wait on the rotation. If the vulnerable endpoint was reachable before you patched, treat the credentials as compromised and act accordingly.

Priority call

This sits at the top of the patch queue. A file-read primitive that hands over application secrets is the starting point for most post-exploitation chains — session token forgery, downstream credential reuse, lateral movement to cloud environments. The gap between disclosure and active exploitation for web-framework vulnerabilities is short. Patch first, then investigate exposure.