PT-2025-33109 · Ruby On Rails+1 · Active Storage+1

CVE-2025-24293 · Published 2025-01-01 · Updated 2026-07-31

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Rails versions 5.2.0 through 7.1.5.1 Rails versions 7.2.0 through 7.2.2.1 Rails versions 8.0.0 through 8.0.2.0

Description Active Storage contains a flaw where the default allowed list of image transformation methods includes three methods that can be used to bypass safe defaults. This allows for potential command injection when applications accept arbitrary user-supplied input as valid transformation methods or parameters. This issue specifically impacts applications using Active Storage with the image processing gem and mini magick as the image processor. An example of vulnerable code involves passing untrusted input to the blob.variant() function, such as using params[:t] and params[:v] to define transformations.

Recommendations Update Rails to version 7.1.5.2, 7.2.2.2, or 8.0.2.1. Perform strict validation of all user-supplied methods and parameters used in image transformations. Deploy a robust ImageMagick security policy. Avoid consuming user-supplied input for image transformation methods or their parameters.

Exploit

Fix

RCE

DoS

Command Injection

Code Injection

Argument Injection

Weakness Enumeration

CWE-77

CWE-94

CWE-88

Related Identifiers

CVE-2025-24293

DLA-4416-1

DSA-6090-1

GHSA-R4MG-4433-C7G3

Affected Products

Active Storage

Debian

References · 32

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2025-24293.yml · Exploit
• https://osv.dev/vulnerability/DLA-4416-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-24293 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-24293 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24293 · Security Note
• https://osv.dev/vulnerability/DSA-6090-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r4mg-4433-c7g3 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-24293 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-24293 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-24293 · Vendor Advisory
• https://github.com/rails/rails · Note
• https://github.com/rails/rails/commit/3beef20013736fd52c5dcfdf061f7999ba318290 · Note
• https://github.com/rails/rails/commit/568c0bc2f1e74c65d150a84b89a080949bf9eb9b · Note
• https://github.com/rails/rails/commit/6a944ca4805e72050a0fbb1a461534eb760d3202 · Note
• https://github.com/rails/rails/commit/2d612735ac0d9712fdfffaf80afa627e7295f6ce · Note