Active Storage in Ruby on Rails uses libvips for image variant processing. libvips includes 'unfuzzed' operations that are unsafe for untrusted content. Active Storage did not disable these operations, allowing an attacker who can upload crafted files to cause arbitrary file reads on the server, including sensitive environment data such as secret_key_base and credentials. This exposure can lead to remote code execution or lateral movement. The vulnerability affects applications using libvips as the variant processor and allowing image uploads from untrusted users. Fixed activestorage versions and libvips >= 8.13 disable these unsafe operations. Secret rotation is required if secrets were exposed. Workarounds involve disabling unfuzzed operations if libvips >= 8.13 is used. No workaround exists for older libvips versions except removing libvips dependency.

An unauthenticated attacker can read arbitrary files on the server hosting the Rails application, including environment variables that contain critical secrets such as secret_key_base and external service credentials. Exposure of these secrets can lead to session hijacking, remote code execution, and lateral movement to other systems. The vulnerability impacts applications using Active Storage with libvips for image processing and accepting image uploads from untrusted users. The severity is critical due to the potential for full system compromise.

Upgrade activestorage to a fixed version (>= 7.2.3.2, >= 8.0.5.1, or >= 8.1.3.1 as appropriate). Upgrade libvips to version 8.13 or later. After upgrading, rotate all secrets accessible to the application process, including secret_key_base, master key, credentials, database credentials, and third-party service tokens. If libvips >= 8.13 is in use but upgrading activestorage is not immediately possible, disable unfuzzed operations by setting the VIPS_BLOCK_UNTRUSTED environment variable or calling Vips.block_untrusted(true) in ruby-vips >= 2.2.1. If libvips < 8.13 is used, the only workaround is to remove libvips from the application. No other mitigations are effective. Technical details are withheld to encourage patching.