Two independent parsing disagreements make this chain reliable. Rails decides a blob is an image by reading a database column, while libvips decides which parser to run by reading the bytes on disk [9]. Then libvips and libmatio disagree with each other about the same MAT header: libvips checks only the first ten bytes for "MATLAB 5.0", libmatio takes the format version from bytes 124 and 125 [9]. A file crafted to satisfy both reaches HDF5 external storage, where the dataset content is pulled from a path and offset the attacker picked and comes back rendered as pixels in the PNG representation [10].
The trust boundary breaks at the front door. In Rails 8.0.5 the standard direct-upload controller creates the blob record before the storage service ever sees the file, taking content_type from the request and writing it straight to the record [8]. Rapid7 is explicit that this particular representation chain is narrower than the advisory: the deployed libvips build has to expose matload with MAT 7.3/HDF5 support, the application has to preserve the attacker-supplied content_type, and the attacker has to be able to trigger a representation, for example with a genuine variation_key from the same application [11] [7]. The underlying failure is broader than those conditions. Active Storage handed untrusted uploads to libvips operations that libvips had already marked unsafe for untrusted content [12].
Order of operations matters for triage. A vulnerable application discloses arbitrary files before the attacker has recovered any Rails secret or forged any token [6], and the file read is what exposes the signing material that turns the bug into code execution [14]. The whole chain runs in a single visit.
On version math: the advisory's floor is 7.2.3.2, with everything below it in range [2], and two of the five targets Rapid7 reproduced against were 6.0.6.1 and 6.1.7.10 [4]. No 6.x fixed release is named, so a Rails 6 application that opted into Vips remediates by moving branches or by dropping the processor, not by a point upgrade [1].
One limit on this reading: the technical post routes affected versions, mitigation guidance, and current exploitation status to Rapid7's separate Emergent Threat Response entry [13]. Treat in-the-wild status as unread here, and check whether your own direct-upload route requires authentication, because the writeup does not settle that for a default app.
