Active Storage Vulnerability in Rails Applications Affects Multiple Versions
CVE-2026-33202
What is CVE-2026-33202?
Active Storage, a component of Rails that enables users to manage file attachments in applications, contains a vulnerability affecting versions before 8.1.2.1, 8.0.4.1, and 7.2.3.1. The flaw arises from the DiskService#delete_prefixed method, which processes blob keys unsafely, allowing for the execution of attacker-controlled input that could include glob metacharacters. This weakness could result in the accidental deletion of unintended files from the storage directory. Rails has addressed this issue in the subsequent releases, urging users to update to the latest versions to mitigate potential risks.
Affected Version(s)
activestorage >= 8.1.0.beta1, < 8.1.2.1 < 8.1.0.beta1, 8.1.2.1
activestorage >= 8.0.0.beta1, < 8.0.4.1 < 8.0.0.beta1, 8.0.4.1
activestorage < 7.2.3.1 < 7.2.3.1