Critical Ruby on Rails Active Storage Vulnerability Allows Arbitrary File Access and Potential RCE

A critical vulnerability in the Ruby on Rails Active Storage framework allows unauthenticated attackers to read arbitrary files from affected applications, with potential escalation to remote code execution (RCE). The flaw was addressed in security patches released by the Rails team, though no specific CVE identifier or exact patch date was provided. The vulnerability specifically impacts the Active Storage component, which handles file uploads and storage in Rails applications. Exploitation could lead to unauthorized data access or full system compromise if successfully escalated. No details on active exploitation or affected version ranges were disclosed in the report.