Critical Ruby on Rails Flaw Could Let Hackers Steal Server Secrets Through Malicious Image Uploads

A critical flaw in Ruby on Rails Active Storage lets an unauthenticated user upload a crafted image and make the server write files. If uploads use the Disk service, the same upload can make the server read files too. The Rails team rated the bug Critical, with a CVSS score of 9.8, and published the advisory on November 4, 2026. The flaw has no... Weiterlesen: Critical Ruby on Rails Flaw Could Let Hackers Steal Server Secrets Th…