Post #4231938

Wonder if this affects Mastodon, via oss-security earlier today: https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm "In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment." "An application is affected if it meets all of these requirements: Uses libvips for Active Storage image processing. This is config.active_storage.variant_processor = :vips, which load_defaults 7.0 set and no later default has changed. Allows image uploads from untrusted users." #mastoadmin