Path Traversal Vulnerability in Active Storage of Rails Applications
CVE-2026-33195
8HIGH
What is CVE-2026-33195?
Active Storage in Rails applications allows users to attach cloud and local files. Prior to the updates in versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the DiskService's path_for method failed to restrict the resolved filesystem path, potentially enabling attackers to exploit path traversal sequences like '../'. This could lead to unauthorized access to arbitrary files, including reading, writing, or deleting them on the server. This vulnerability particularly affects applications that inadvertently use user-controlled input as blob keys, compromising their file security.
Affected Version(s)
activestorage >= 8.1.0.beta1, < 8.1.2.1 < 8.1.0.beta1, 8.1.2.1
activestorage >= 8.0.0.beta1, < 8.0.4.1 < 8.0.0.beta1, 8.0.4.1
activestorage < 7.2.3.1 < 7.2.3.1