PT-2025-33109 · Ruby On Rails+1 · Active Storage+1

Published 2025-01-01 · Updated 2026-01-30 · CVE-2025-24293

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: Active Storage versions 5.2.0 through 8.0.2.1

Description: Active Storage allows the use of potentially unsafe image transformation methods and parameters by default. This can lead to command injection vulnerabilities when arbitrary user-supplied input is accepted as valid transformation methods or parameters. Vulnerable code may resemble the following: <%= image tag blob.variant(params[:t] => params[:v]) %>, where the transformation method or its arguments are untrusted arbitrary input.

Recommendations: Active Storage versions 5.2.0 through 7.1.5.1 should be upgraded. Active Storage versions 5.2.0 through 7.2.2.1 should be upgraded. Active Storage versions 5.2.0 through 8.0.2.0 should be upgraded. Strict validation of user-supplied methods and parameters should be performed. A strong ImageMagick security policy should be deployed.

Exploit

Fix

RCE

Command Injection

Code Injection

Weakness Enumeration

CWE-77

CWE-94

Related Identifiers

CVE-2025-24293

DLA-4416-1

DSA-6090-1

GHSA-R4MG-4433-C7G3

Affected Products

Active Storage

Debian

References · 27

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2025-24293.yml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-24293 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-24293 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-24293 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4416-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-24293 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-24293 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-6090-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-24293 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r4mg-4433-c7g3 · Vendor Advisory
• https://github.com/rails/rails · Note
• https://github.com/rails/rails/commit/6a944ca4805e72050a0fbb1a461534eb760d3202 · Note
• https://github.com/rails/rails/commit/568c0bc2f1e74c65d150a84b89a080949bf9eb9b · Note
• https://github.com/rails/rails/commit/3beef20013736fd52c5dcfdf061f7999ba318290 · Note
• https://github.com/rails/rails/security/advisories/GHSA-r4mg-4433-c7g3 · Note