CVE-2026-33195 Details
Description
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
A path traversal vulnerability has been identified in the DiskService component of Rails Active Storage, affecting versions 8.1.0 through 8.1.2, 8.0.0 through 8.0.4, and prior to 7.2.3.1. The issue arises because the DiskService#path_for method does not properly validate that the resolved filesystem path stays within the designated storage root. This oversight can be exploited by using a blob key that includes path traversal sequences, such as '../', potentially allowing unauthorized reading, writing, or deletion of files on the server. While blob keys are generally considered trusted, there is a risk that some applications may inadvertently pass user input as keys, leading to exploitation.
Users can upgrade to Active Storage versions 8.1.2.1, 8.0.4.1, or 7.2.3.1, all of which include the necessary path traversal validation. Instructions for upgrading can be found in the Rails release notes.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | redhat-SADP |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| rubyonrails rails | < 7.2.3.1 >= 8.0.0, < 8.0.4.1 >= 8.1.0, < 8.1.2.1 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 24, 2026 | Initial Analysis | [email protected] |
| Mar 24, 2026 | New CVE Received | [email protected] |