Active Storage is the Rails subsystem for handling file attachments such as images, documents, and other user uploads. It stores the original file and can generate derivatives, including on-demand image variants, through server-side processing. That makes it more than a simple upload bucket: it is part of the application’s trust boundary.
It matters in security because any code path that transforms untrusted uploads can become an attack surface. If variant generation relies on vulnerable libraries or unsafe input handling, a routine thumbnail request may expose local files, configuration data, or other server-resident content. Defenders should inventory where Active Storage is used, which variant processor is configured, and whether uploaded files are being processed by trusted libraries with current patches.