Arbitrary File Upload Vulnerability in Active Storage for Rails Applications by Rails
CVE-2026-33173
5.3MEDIUM
What is CVE-2026-33173?
Active Storage, a feature in Rails applications that allows users to attach cloud and local files, has a vulnerability that impacts versions prior to 8.1.2.1, 8.0.4.1, and 7.2.3.1. The DirectUploadsController does not adequately validate metadata provided by the client. An attacker can manipulate the metadata to set internal flags, thereby bypassing MIME detection and validations. This can lead to the upload of malicious content disguised as a safe file type. It is strongly recommended that affected users update to the patched versions to mitigate this security risk.
Affected Version(s)
activestorage >= 8.1.0.beta1, < 8.1.2.1 < 8.1.0.beta1, 8.1.2.1
activestorage >= 8.0.0.beta1, < 8.0.4.1 < 8.0.0.beta1, 8.0.4.1
activestorage < 7.2.3.1 < 7.2.3.1