Affected Systems
Ruby on Rails 7.0.0–7.2.3.1, 8.0.0–8.0.5, 8.1.0–8.1.3 using Active Storage with libvips for image processing and accepting untrusted uploads. Rails 6.0.0–6.1.7.10 affected only when Vips explicitly configured (non-default). Applications using MiniMagick are not affected.
Exploitation Status
No known exploitation in the wild as of July 30, 2026. Third-party PoC published demonstrating arbitrary file read to RCE chain via crafted MATLAB/HDF5 upload, though not independently validated. Researchers have not disclosed full attack details; Rails will release technical details by August 28, 2026.
Business Impact
Unauthenticated attackers can read arbitrary files accessible to the Rails worker process, including secret_key_base, master.key, database credentials, cloud storage keys, and API tokens. Exposed secrets enable remote code execution via deserialization attacks and lateral movement to connected systems. Impact limited to applications using Vips for Active Storage image processing and accepting untrusted uploads; no telemetry exists to estimate exposure. Rails 7.1 and earlier are end-of-life and will not receive patches.
Urgency
🔴 Immediate
Recommended Actions
- Upgrade to Rails 7.2.3.2, 8.0.5.1, or 8.1.3.1 immediately if using Active Storage with Vips and accepting untrusted image uploads
- Ensure libvips 8.13 or later and ruby-vips 2.2.1 or later are installed after patching Rails
- Rotate all secrets readable by the Rails process: secret_key_base, master.key, decrypted credentials, database passwords, Active Storage service keys, and third-party API tokens
- If immediate Rails upgrade is not possible, set VIPS_BLOCK_UNTRUSTED=true environment variable (requires libvips 8.13+) or call Vips.block_untrusted(true) in application initialization (requires ruby-vips 2.2.1+)
- Review Active Storage upload logs for suspicious MATLAB, HDF5, or unusual image format uploads since Rails 7.0 deployment; monitor for unauthorized file access attempts