Action Pack allows handling of web requests. Prior to specific releases, Active Storage still permits libvips operations that are marked unsafe for untrusted content. A crafted upload can trigger those operations, enabling an attacker who does not need authentication to read any file that the Rails process can access, such as environment variables or application secrets. Exposure of secrets like secret_key_base or external‑service tokens can lead to remote code execution or lateral movement. The weakness is a classic case of improper restriction of operations on untrusted input, corresponding to CWE‑1188.

Rails applications built on the Action Pack framework with libvips configured to process image uploads. Versions before 7.2.3.2, 8.0.5.1 and 8.1.3.1 are affected. Upgrading to the listed releases or any later version therefore mitigates the issue.

The CVSS score of 9.5 indicates critical severity. An EPSS score of 2% shows that the exploit is currently considered likely enough to be of concern. Although the vulnerability is not in the CISA KEV catalog, the risk is real for any application accepting file uploads from untrusted users. The attack vector is an unauthenticated image upload that triggers an unsafe libvips operation, resulting in unauthorized file read and potentially life‑changing credential exposure.