6.6
Moyenne
CVE-2026-33202 Active Storage allows users to attach cloud and local files in Rails applications
Description
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| activestorage 8.1 | 8.1.0.beta1 → < 8.1.2.1 | 8.1.2.1 |
| activestorage 8.0 | 8.0.0.beta1 → < 8.0.4.1 | 8.0.4.1 |
| activestorage 7.2 | premières → < 7.2.3.1 | 7.2.3.1 |
Références
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de activestorage
Les 6 CVE de activestorage →
CVE-2026-33658
Active Storage allows users to attach cloud and local files in Rails applications
2.3
Faible
CVE-2026-33195
Active Storage allows users to attach cloud and local files in Rails applications
8.0
Élevée
CVE-2026-33174
Active Storage allows users to attach cloud and local files in Rails applications
6.6
Moyenne
CVE-2026-33173
Active Storage allows users to attach cloud and local files in Rails applications
5.3
Moyenne