CriticalDark Reading
A Poisoned Profile Picture Can Spill a Rails App’s Secrets
Rails patched a critical Active Storage flaw (GHSA-f3w6-w445-fwh9, CVSS 9.8) where a crafted image upload makes ImageMagick write files and, with Disk storage, read secrets like secret_key_base. Fixed in 8.0.5.2 and 8.1.4.1.