What is CVE-2025-24293?

CVE-2025-24293 is a high-severity vulnerability in Rails Activestorage, classified under Command Injection. CVSS score: 8.1/10. Published 2026-01-30.

How severe is CVE-2025-24293?

High severity. CVSS v3 base score is 8.1 out of 10.

Is CVE-2025-24293 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Rails Activestorage

CVE-2025-24293

# Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default. The default allowed list contains three meth…

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.024 (82.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Rails Activestorage — versions 5.2, 7.0, 8.0

Weakness classification (CWE)

Public proof-of-concept exploits

usutani/study-turbolinks-link

References

Frequently asked questions

What is CVE-2025-24293?: CVE-2025-24293 is a high-severity vulnerability in Rails Activestorage, classified under Command Injection. CVSS score: 8.1/10. Published 2026-01-30.
How severe is CVE-2025-24293?: High severity. CVSS v3 base score is 8.1 out of 10.
Is CVE-2025-24293 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.