Critical Rails Active Storage bug enables unauthenticated file read and RCE
A GitHub security advisory (GHSA‑xr9x‑r78c‑5hrm) reveals that Rails’ Active Storage variant processing with libvips can be abused to read any server file and, because environment secrets such as secret_key_base are exposed, can lead to remote code execution. Upgrading Active Storage (or libvips ≥ 8.13) and rotating all secrets mitigates the risk.