Code Injection Vulnerability in Active Storage by Rails
CVE-2022-21831
9.8CRITICAL
Key Information:
- Vendor
Rubyonrails
- Vendor
- CVE Published:
- 26 May 2022
What is CVE-2022-21831?
A code injection vulnerability is present in Active Storage versions 5.2.0 and later. This flaw can be exploited if an attacker crafts malicious image_processing arguments, potentially leading to unauthorized code execution on the affected system. It highlights the importance of ensuring that user-input data is properly validated and sanitized to mitigate such risks.
Affected Version(s)
https://github.com/rails/rails 7.0.2.3, 6.1.4.7, 6.0.4.7, 5.2.6.3