Rails Active Storage: a critical flaw with arbitrary file read and RCE potential
> In short: A critical vulnerability in the Ruby on Rails Active Storage framework allows an unauthenticated attacker to read arbitrary files from the server's filesystem, with potential escalation to remote code execution. Active Storage is the default file-upload handling in Rails applications. A patched version is available.
Why this matters to you
If your SaaS product is built on Ruby on Rails — and a significant share of French startups and SaaS vendors use Rails — Active Storage is almost certainly in your stack. It handles file uploads (avatars, documents, attachments) by default. This flaw doesn't require authentication, which means any internet-facing Rails app with Active Storage enabled is potentially vulnerable.
The blog already covers CVE-2019-5418 (Rails Action View file read) — this is the same class of vulnerability (arbitrary file read) on a different Rails component, and the escalation path to RCE makes it worse.
The flaw class
The vulnerability allows an attacker to read arbitrary files from the server. In Rails, the most sensitive targets are:
config/database.yml — database credentials.config/master.key or config/credentials.yml.enc — the Rails encryption key, which decrypts stored secrets (API keys, third-party tokens)./etc/passwd, environment variables — system information for further exploitation.From file read to RCE: if the attacker can read the Rails master key, they can decrypt credentials.yml.enc and extract every secret stored there — including API keys for cloud providers, third-party services, and internal APIs. With those credentials, the attacker pivots to RCE on dependent infrastructure (deploy a container with stolen cloud credentials, access an internal API with admin tokens).
What to do
The Rails pattern
Rails has a history of file-read vulnerabilities (CVE-2019-5418 was Action View, this is Active Storage). The framework's convention-over-configuration approach makes it easy to ship features quickly but also creates predictable file locations that attackers target. For a SaaS vendor on Rails: keep your framework version current, treat the master key as your most sensitive credential, and assume any file-read vulnerability is effectively a full secret compromise.
Building HR, payroll, or recruiting software? CleanIssue performs security audits for HR SaaS in real-world conditions, no source code access needed. For a first read of your exposure, start with an external review of your application.
Related articles
Three adjacent analyses to keep exploring the same attack surface.
Fastjson 1.x CVE-2026-16723: a critical RCE with no patch, actively exploited
A CVSS 9.0 remote code execution flaw in Alibaba's Fastjson 1.2.68–1.2.83 lets an unauthenticated attacker run code on affected Spring Boot fat-JAR applications. No AutoType or classpath gadget required. No 1.x patch exists yet. Workaround: SafeMode.
SharePoint CVE-2026-58644: a critical RCE zero-day added to the CISA KEV catalog
A deserialization flaw (CVSS 9.8) in Microsoft SharePoint Server lets an attacker authenticated as Site Owner execute arbitrary code remotely. Actively exploited as a zero-day, added to the CISA KEV catalog on July 16, 2026 with a July 19 remediation deadline.
Adobe ColdFusion CVE-2026-48282: a max-severity RCE exploited within 2 hours of disclosure
A maximum-severity flaw (CVSS 9.8) in Adobe ColdFusion 2025.9, 2023.20 and earlier allows unauthenticated remote code execution. Exploitation started within 2 hours of Adobe's disclosure. ~800 instances exposed online. Fix available.
Sources
Related services
If this topic maps to a real risk in your stack, these are the most relevant CleanIssue audits.