Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
11 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment. That environment typically holds secretkeybase and often credentials for external systems, which may in turn allow escalation to remote code execution or lateral movement to those systems. Details libvips reads and writes file formats through "loaders" and "savers" (or more generally "operations"), many of which are backed by third-party libraries. It marks some of these operations as "unfuzzed", meaning they are unsafe for untrusted content, and several handle formats unrelated to web images. Active Storage did not disable the unfuzzed operations, so an attacker who can upload a crafted file and cause a variant to be generated from it may be able to invoke one. We are aware of a mechanism by which an attacker, by uploading a crafted file, is able to cause disclosure of the contents of…
Recommended action: Upgrade to 8.1.3.1, 8.0.5.1 or 7.2.3.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Releases The fixed releases are available at the normal locations. Credit This issue was responsibly reported by Hackerone researcher thwinhtet.
Recommended action: Upgrade to 8.1.2.1, 8.0.4.1 or 7.2.3.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Active Storage's DiskService#deleteprefixed passes blob keys directly to Dir.glob without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory. Releases The fixed releases are available at the normal locations.
Recommended action: Upgrade to 8.1.2.1, 8.0.4.1 or 7.2.3.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Active Storage's DiskService#pathfor does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. ../) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Releases The fixed releases are available at the normal locations. Credit This issue was responsibly reported by Hackerone researcher ksw9722.
Recommended action: Upgrade to 8.1.2.1, 8.0.4.1 or 7.2.3.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact When serving files through Active Storage's Blobs::ProxyController, the controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. bytes=0-) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Releases The fixed releases are available at the normal locations. Credit This issue was responsibly reported by Hackerone user pirikara
Recommended action: Upgrade to 8.1.2.1, 8.0.4.1 or 7.2.3.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Active Storage's DirectUploadsController accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like identified and analyzed are stored in the same metadata hash, a malicious direct-upload client could set these flags. Releases The fixed releases are available at the normal locations. Credit This was responsible reported by Hackerone researcher pwnie
Recommended action: Upgrade to 8.1.2.1, 8.0.4.1 or 7.2.3.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default. The default allowed list contains three methods allowing for the circumvention of the safe defaults which enables potential command injection vulnerabilities in cases where arbitrary user supplied input is accepted as valid transformation methods or parameters. This has been assigned the CVE identifier CVE-2025-24293. Versions Affected: = 5.2.0 Not affected: < 5.2.0 Fixed Versions: 7.1.5.2, 7.2.2.2, 8.0.2.1 Impact ------ This vulnerability impacts applications that use Active Storage with the imageprocessing processing gem in addition to minimagick as the image processor. Vulnerable code will look something similar to this: Where the transformation method or its arguments are untrusted arbitrary input. All users running an affected release should either upgrade or use one of the workarounds immediately. Releases -------- The fixed releases are available at the…
Recommended action: Upgrade to 8.0.2.1, 7.2.2.2 or 7.1.5.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Possible Sensitive Session Information Leak in Active Storage There is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. This vulnerability has been assigned the CVE identifier CVE-2024-26144. Versions Affected: = 5.2.0, < 7.1.0 Not affected: < 5.2.0, 7.1.0 Fixed Versions: 7.0.8.1, 6.1.7.7 Impact ------ A proxy which chooses to caches this request can cause users to share sessions. This may include a user receiving an attacker's session or vice versa. This was patched in 7.1.0 but not previously identified as a security vulnerability. All users running an affected release should either upgrade or use one of the workarounds immediately. Releases -------- The fixed releases are available at the normal locations. Workarounds ----------- Upgrade to Rails…
Recommended action: Upgrade to 7.0.8.1 or 6.1.7.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
6.1.4.77.0.2.36.0.4.75.2.6.3· Vendor fix available
Issue
The Active Storage module of Rails starting with version 5.2.0 is possibly vulnerable to code injection. This issue was patched in versions 5.2.6.3, 6.0.4.7, 6.1.4.7, and 7.0.2.3. To work around this issue, applications should implement a strict allow-list on accepted transformation methods or arguments. Additionally, a strict ImageMagick security policy will help mitigate this issue.
Recommended action: Upgrade to 7.0.2.3, 6.1.4.7, 6.0.4.7 or 5.2.6.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a vulnerability in ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user. Versions Affected: rails < 5.2.4.2, rails < 6.0.3.1 Not affected: Applications that do not use the direct upload functionality of the ActiveStorage S3 adapter. Fixed Versions: rails = 5.2.4.3, rails = 6.0.3.1 Impact ------ Utilizing this vulnerability, an attacker can control the Content-Length of an S3 direct upload URL without receiving a new signature from the server. This could be used to bypass controls in place on the server to limit upload size. Workarounds ----------- This is a low-severity security issue. As such, no workaround is necessarily until such time as the application can be upgraded.
Recommended action: Upgrade to 6.0.3.1 or 5.2.4.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A bypass vulnerability in Active Storage = 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the content-disposition and content-type parameters which can be used in with HTML files and have them executed inline. Additionally, if combined with other techniques such as cookie bombing and specially crafted AppCache manifests, an attacker can gain access to private signed URLs within a specific storage path. Vulnerable apps are those using either GCS or the Disk service in production. Other storage services such as S3 or Azure aren't affected.
Recommended action: Upgrade to 5.2.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.