Rails Active Storage CVE-2025-24293

Exploitation requires the application to use Active Storage with the image_processing gem AND the MiniMagick processor (ImageMagick backend), AND to pass arbitrary untrusted user input as the variant transformation method or its parameters (e.g. blob.variant(params[:t] => params[:v])). The specific enabler is that three methods on Active Storage's default allowed-methods list can be used to bypass the safe-transformation defaults. Limiting factors: default Rails applications that do not feed user input into transformation methods/parameters are NOT exploitable (the CVSS 4.0 AT:P attack requirement reflects exactly this precondition); using a different image processor than MiniMagick, or applying server-side validation/fixed transformation mappings, also prevents exploitation. No attacker authentication is required (PR:N) and no user interaction is needed (UI:N), but the insecure application coding pattern must be present.

Signals are mixed and must be weighed together. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.2) reflects high technical impact (full confidentiality/integrity/availability loss) reachable over the network without privileges or user interaction - but it critically includes AT:P, an Attack Requirement, meaning successful exploitation depends on a precondition: the application must actually pass untrusted user input into transformation methods/parameters, behavior Rails explicitly documents as unsupported and dangerous. This is therefore not exploitable against a default Rails app; it requires an insecure application coding pattern plus the image_processing + MiniMagick stack. EPSS is low (0.22%, 44th percentile) and no POC is identified, consistent with a vulnerability gated behind non-default, developer-introduced usage rather than a universally exploitable flaw. It is not in CISA KEV. Net: a genuinely high-severity, RCE-class issue worth prompt patching, but real-world exposure is narrow and conditional on application code, not a mass-exploitable internet-wide bug.

An application renders user-customizable image variants, e.g. image_tag blob.variant(params[:t] => params[:v]), exposing the transformation method and value to request input. A remote attacker submits a crafted method/parameter pair that selects one of the three circumvention-enabling allow-list methods and smuggles shell metacharacters into the MiniMagick/ImageMagick command, achieving OS command execution on the server. No public exploit code is identified at time of analysis, and the network/low-complexity vector still requires the app to expose this unsafe pattern (AT:P).