Every CVE Search/ Get API key

CVE-2025-24293

Active Storage allowed transformation methods that were potentially unsafe

9.2 CriticalPublic exploitFix available

Active Storage allowed transformation methods potentially unsafe

Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default.

The default allowed list contains three methods allow for the circumvention of the safe defaults which enables potential command injection vulnerabilities in cases where arbitrary user supplied input is accepted as valid transformation methods or parameters.

Impact

This vulnerability impacts applications that use Active Storage with the image_processing processing gem in addition to mini_magick as the image processor.

Vulnerable code will look something similar to this:

<%= image_tag blob.variant(params[:t] => params[:v]) %>

Where the transformation method or its arguments are untrusted arbitrary input.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Workarounds

Consuming user supplied input for image transformation methods or their parameters is unsupported behavior and should be considered dangerous.

Strict validation of user supplied methods and parameters should be performed as well as having a strong ImageMagick security policy deployed.

Credits

Thank you lio346 for reporting this!

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

5.58%Up 5.5 points since Jan 31, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.2

Active Storage allowed transformation methods potentially unsafe

Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default.

The default allowed list contains three methods allow for the circumvention of the safe defaults which enables potential command injection vulnerabilities in cases where arbitrary user supplied input is accepted as valid transformation methods or parameters.

Impact

This vulnerability impacts applications that use Active Storage with the image_processing processing gem in addition to mini_magick as the image processor.

Vulnerable code will look something similar to this:

<%= image_tag blob.variant(params[:t] => params[:v]) %>

Where the transformation method or its arguments are untrusted arbitrary input.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Workarounds

Consuming user supplied input for image transformation methods or their parameters is unsupported behavior and should be considered dangerous.

Strict validation of user supplied methods and parameters should be performed as well as having a strong ImageMagick security policy deployed.

Credits

Thank you lio346 for reporting this!

Record
CVE-2025-24293
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94, CWE-77, CWE-88
Updated
2026-11-02
EUVDEUVD-2025-29509 9.2

Active Storage allowed transformation methods potentially unsafe

Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default.

The default allowed list contains three methods allow for the circumvention of the safe defaults which enables potential command injection vulnerabilities in cases where arbitrary user supplied input is accepted as valid transformation methods or parameters.

Impact

This vulnerability impacts applications that use Active Storage with the image_processing processing gem in addition to mini_magick as the image processor.

Vulnerable code will look something similar to this:

<%= image_tag blob.variant(params[:t] => params[:v]) %>

Where the transformation method or its arguments are untrusted arbitrary input.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Workarounds

Consuming user supplied input for image transformation methods or their parameters is unsupported behavior and should be considered dangerous.

Strict validation of user supplied methods and parameters should be performed as well as having a strong ImageMagick security policy deployed.

Credits

Thank you lio346 for reporting this!

Record
EUVD-2025-29509
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-r4mg-4433-c7g3 9.2

Active Storage allowed transformation methods that were potentially unsafe

Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default.

The default allowed list contains three methods allowing for the circumvention of the safe defaults which enables potential command injection vulnerabilities in cases where arbitrary user supplied input is accepted as valid transformation methods or parameters.

This has been assigned the CVE identifier CVE-2025-24293.

Versions Affected: >= 5.2.0 Not affected: < 5.2.0 Fixed Versions: 7.1.5.2, 7.2.2.2, 8.0.2.1

Impact

This vulnerability impacts applications that use Active Storage with the image_processing processing gem in addition to mini_magick as the image processor.

Vulnerable code will look something similar to this:

<%= image_tag blob.variant(params[:t] => params[:v]) %>

Where the transformation method or its arguments are untrusted arbitrary input.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases

The fixed releases are available at the normal locations.

Workarounds

Consuming user supplied input for image transformation methods or their parameters is unsupported behavior and should be considered dangerous.

Strict validation of user supplied methods and parameters should be performed as well as having a strong ImageMagick security policy deployed.

Credits

Thank you lio346 from Unit 515 of OPSWAT for reporting this!

Record
GHSA-r4mg-4433-c7g3
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-77
Updated
2026-11-02
NVD 9.2

Active Storage allowed transformation methods potentially unsafe

Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default.

The default allowed list contains three methods allow for the circumvention of the safe defaults which enables potential command injection vulnerabilities in cases where arbitrary user supplied input is accepted as valid transformation methods or parameters.

Impact

This vulnerability impacts applications that use Active Storage with the image_processing processing gem in addition to mini_magick as the image processor.

Vulnerable code will look something similar to this:

<%= image_tag blob.variant(params[:t] => params[:v]) %>

Where the transformation method or its arguments are untrusted arbitrary input.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Workarounds

Consuming user supplied input for image transformation methods or their parameters is unsupported behavior and should be considered dangerous.

Strict validation of user supplied methods and parameters should be performed as well as having a strong ImageMagick security policy deployed.

Credits

Thank you lio346 for reporting this!

Record
CVE-2025-24293
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-77, CWE-94, CWE-88
Updated
2026-11-02
OSVDEBIAN-CVE-2025-24293 9.2

Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default. The default allowed list contains three methods allow for the circumvention of the safe defaults which enables potential command injection vulnerabilities in cases where arbitrary user supplied input is accepted as valid transformation methods or parameters. Impact ------ This vulnerability impacts applications that use Active Storage with the image_processing processing gem in addition to mini_magick as the image processor. Vulnerable code will look something similar to this: <%= image_tag blob.variant(params[:t] => params[:v]) %> Where the transformation method or its arguments are untrusted arbitrary input. All users running an affected release should either upgrade or use one of the workarounds immediately. Workarounds ----------- Consuming user supplied input for image transformation methods or their parameters is unsupported behavior and should be considered dangerous. Strict validation of user supplied methods and parameters should be performed as well as having a strong ImageMagick security policy deployed. Credits ------- Thank you lio346 for reporting this!

Record
DEBIAN-CVE-2025-24293
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVGHSA-r4mg-4433-c7g3 9.2

Active Storage allowed transformation methods that were potentially unsafe

Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default.

The default allowed list contains three methods allowing for the circumvention of the safe defaults which enables potential command injection vulnerabilities in cases where arbitrary user supplied input is accepted as valid transformation methods or parameters.

This has been assigned the CVE identifier CVE-2025-24293.

Versions Affected: >= 5.2.0 Not affected: < 5.2.0 Fixed Versions: 7.1.5.2, 7.2.2.2, 8.0.2.1

Impact

This vulnerability impacts applications that use Active Storage with the image_processing processing gem in addition to mini_magick as the image processor.

Vulnerable code will look something similar to this:

<%= image_tag blob.variant(params[:t] => params[:v]) %>

Where the transformation method or its arguments are untrusted arbitrary input.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases

The fixed releases are available at the normal locations.

Workarounds

Consuming user supplied input for image transformation methods or their parameters is unsupported behavior and should be considered dangerous.

Strict validation of user supplied methods and parameters should be performed as well as having a strong ImageMagick security policy deployed.

Credits

Thank you lio346 from Unit 515 of OPSWAT for reporting this!

Record
GHSA-r4mg-4433-c7g3
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-77
Updated
2026-11-02
OSVUBUNTU-CVE-2025-24293 9.2

Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default. The default allowed list contains three methods allow for the circumvention of the safe defaults which enables potential command injection vulnerabilities in cases where arbitrary user supplied input is accepted as valid transformation methods or parameters. Impact ------ This vulnerability impacts applications that use Active Storage with the image_processing processing gem in addition to mini_magick as the image processor. Vulnerable code will look something similar to this: <%= image_tag blob.variant(params[:t] => params[:v]) %> Where the transformation method or its arguments are untrusted arbitrary input. All users running an affected release should either upgrade or use one of the workarounds immediately. Workarounds ----------- Consuming user supplied input for image transformation methods or their parameters is unsupported behavior and should be considered dangerous. Strict validation of user supplied methods and parameters should be performed as well as having a strong ImageMagick security policy deployed. Credits ------- Thank you lio346 for reporting this!

Record
UBUNTU-CVE-2025-24293
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
activestorage
RubyGems
 8.0 up to 8.0.2.1
8.0.2.1
activestorage
RubyGems
 7.2 up to 7.2.2.2
7.2.2.2
activestorage
RubyGems
 5.2.0 up to 7.1.5.2
7.1.5.2
rails
Debian:12
 before 2:6.1.7.10+dfsg-1~deb12u2, plus listed versions
2:6.1.7.10+dfsg-1~deb12u12:6.1.7.3+dfsg-12:6.1.7.3+dfsg-102:6.1.7.3+dfsg-112:6.1.7.3+dfsg-12
Show 11 moreShow less
2:6.1.7.3+dfsg-132:6.1.7.3+dfsg-22:6.1.7.3+dfsg-2~deb12u12:6.1.7.3+dfsg-32:6.1.7.3+dfsg-42:6.1.7.3+dfsg-52:6.1.7.3+dfsg-62:6.1.7.3+dfsg-72:6.1.7.3+dfsg-7~exp12:6.1.7.3+dfsg-82:6.1.7.3+dfsg-9
2:6.1.7.10+dfsg-1~deb12u2
rails
Debian:13
 before 2:7.2.2.2+dfsg-2~deb13u1, plus listed versions
2:7.2.2.1+dfsg-72:7.2.2.2+dfsg-1
2:7.2.2.2+dfsg-2~deb13u1
rails
Debian:14
 before 2:7.2.2.2+dfsg-1, plus listed versions
2:7.2.2.1+dfsg-7
2:7.2.2.2+dfsg-1
rails
Debian:11
 before 2:6.0.3.7+dfsg-2+deb11u4, plus listed versions
2:6.0.3.7+dfsg-22:6.0.3.7+dfsg-2+deb11u12:6.0.3.7+dfsg-2+deb11u22:6.0.3.7+dfsg-2+deb11u3
2:6.0.3.7+dfsg-2+deb11u4
activestorage
RubyGems
 8.0 up to 8.0.2.1, plus listed versions
8.0.08.0.0.18.0.18.0.2
8.0.2.1
activestorage
RubyGems
 7.2 up to 7.2.2.2, plus listed versions
7.2.07.2.17.2.1.17.2.1.27.2.27.2.2.1
7.2.2.2
activestorage
RubyGems
 5.2.0 up to 7.1.5.2, plus listed versions
5.2.15.2.1.15.2.1.rc15.2.25.2.2.1
Show 45 moreShow less
5.2.2.rc15.2.35.2.3.rc15.2.45.2.4.15.2.4.25.2.4.35.2.4.45.2.4.55.2.4.65.2.4.rc15.2.55.2.65.2.6.15.2.6.25.2.6.35.2.75.2.7.15.2.85.2.8.16.0.06.0.0.beta16.0.0.beta26.0.0.beta36.0.0.rc16.0.0.rc26.0.16.0.1.rc16.0.26.0.2.16.0.2.26.0.2.rc16.0.2.rc26.0.36.0.3.16.0.3.26.0.3.36.0.3.46.0.3.56.0.3.66.0.3.76.0.3.rc16.0.46.0.4.16.0.4.2
7.1.5.2
Show 8 moreShow less
Affected packages
PackageAffectedFixed
rails
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2:4.1.10-12:4.2.5-12:4.2.5.1-12:4.2.5.2-22:4.2.6-12:4.2.6-1ubuntu0.1~esm12:4.2.6-1ubuntu0.1~esm2
 None known
rails
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2:4.2.9-22:4.2.9-42:4.2.10-0ubuntu42:4.2.10-0ubuntu4+esm12:4.2.10-0ubuntu4+esm2
 None known
rails
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2:5.2.2.1+dfsg-1ubuntu12:5.2.3+dfsg-32:5.2.3+dfsg-3ubuntu0.1~esm1
 None known
rails
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2:6.0.3.7+dfsg-22:6.1.4.1+dfsg-8ubuntu22:6.1.4.1+dfsg-8ubuntu2+esm1
 None known
rails
Ubuntu:24.04:LTS
 All versions, plus listed versions
2:6.1.7.3+dfsg-2build12:6.1.7.3+dfsg-3
 None known
rails
Ubuntu:25.10
 All versions, plus listed versions
2:6.1.7.3+dfsg-72:7.2.2.1+dfsg-7
 None known
rails
Ubuntu:26.10
 All versions, plus listed versions
2:7.2.3+dfsg-22:7.2.3.2+dfsg-2
 None known
rails
Ubuntu:26.04:LTS
 All versions, plus listed versions
2:7.2.2.1+dfsg-72:7.2.2.2+dfsg-22:7.2.3+dfsg-2
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitRuby on Rails Active Storage Vips Arbitrary File Read and Remote Code Execution2026-07-29
PoC in GitHubusutani/study-turbolinks-link2020-04-05

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-24293 is a critical vulnerability (CVSS 9.2) in Rails Activestorage, published August 14, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.58%, the 92nd percentile. Fixed in activestorage 8.0.2.1.

References

Show 11 moreShow less
This page doesn't list everything

Left out here: 91 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open