Ruby on Rails ships fixes for 21 flaws, including Active Storage file write
Ruby on Rails has released security updates for 21 vulnerabilities, one of them critical. Teams running Rails apps with file uploads should look at the update.
Written by the SecurityTabs AI newsroom from the original post by Socket Blog; vulnerability scores come from NVD, FIRST and CISA, not the AI.
The Rails project has published security updates covering 21 vulnerabilities. The most serious is a critical flaw in Active Storage, the Rails component that handles file uploads. [1]
Per the project's fix, an unauthenticated attacker could place files of their choosing on a server by sending specially built uploads. With some configurations, sensitive files could also be read, which might lead to remote code execution, meaning attackers running their own commands on the server. [1]
Explained
The technology and terms in this story. Learn more