Rails
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Security timeline
- Vulnerability reported by Canadian Centre for Cyber SecurityRails Active Storage flaw allows possible arbitrary file write and read
- Vulnerability reported by Dark ReadingCritical Rails bug could let attackers write and read files via uploaded images
Recent news
Rails Active Storage flaw allows possible arbitrary file write and read
The Canadian Centre for Cyber Security has issued advisory AV26-1129 for Rails Active Storage, the component that manages file uploads. The flaw in image analysis could allow arbitrary file write and read. Versions prior to 8.0.5.2 and prior to 8.1.4.1 are affected, so administrators should move to the fixed release for their branch.
Critical Rails bug could let attackers write and read files via uploaded images
A critical vulnerability affects the Rails Active Storage integration with ImageMagick. Crafted images uploaded to an application can be used to write arbitrary files and read sensitive files, potentially enabling lateral movement by a threat actor.