6.6
Medium
CVE-2026-33202 Active Storage allows users to attach cloud and local files in Rails applications
Description
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| activestorage 8.1 | 8.1.0.beta1 → < 8.1.2.1 | 8.1.2.1 |
| activestorage 8.0 | 8.0.0.beta1 → < 8.0.4.1 | 8.0.4.1 |
| activestorage 7.2 | earliest → < 7.2.3.1 | 7.2.3.1 |
References
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of activestorage
The 6 CVEs of activestorage →
CVE-2026-33658
Active Storage allows users to attach cloud and local files in Rails applications
2.3
Low
CVE-2026-33195
Active Storage allows users to attach cloud and local files in Rails applications
8.0
High
CVE-2026-33174
Active Storage allows users to attach cloud and local files in Rails applications
6.6
Medium
CVE-2026-33173
Active Storage allows users to attach cloud and local files in Rails applications
5.3
Medium