#activestorage

Rails Active Storage flaw allows arbitrary file reads via image variants

Unauthenticated attackers can leak server secrets, and potentially escalate to RCE, on apps using libvips with untrusted uploads.