Definition
Critical vulnerability (CVSS 9.5, CWE-1188) in Rails active-storage when using libvips: unauthenticated arbitrary file read (including process environment secrets) via crafted image uploads, with possible RCE escalation path.
Key Points
- Patched: Active Storage 7.2.3.2, 8.0.5.1, 8.1.3.1; require libvips ≥8.13
- Workaround without Rails upgrade (libvips ≥8.13):
VIPS_BLOCK_UNTRUSTED - Rotate
secret_key_baseand all env-accessible secrets after exposure risk - Rapid7: no known in-the-wild exploitation as of 2026-07-30
- Attack-chain details deferred by Rails until 2026-08-28