Rails Active Storage flaw allows possible arbitrary file write and read
VULNERABILITYActive Storageredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
The Canadian Centre for Cyber Security has issued advisory AV26-1129 for Rails Active Storage, the component that manages file uploads. The flaw in image analysis could allow arbitrary file write and read. Versions prior to 8.0.5.2 and prior to 8.1.4.1 are affected, so administrators should move to the fixed release for their branch.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Upgrade Rails Active Storage to 8.0.5.2 or later if you run the 8.0 branch.
- Upgrade Rails Active Storage to 8.1.4.1 or later if you run the 8.1 branch.
- Review the linked Rails 8.0.5.2 and 8.1.4.1 release notes.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Canadian Centre for Cyber Security
Who and what is in it
Companies
Products