CVE-2026-33202
published 2026-03-24CVE-2026-33202: Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's…
PriorityP352critical9.1CVSS 3.1
AVNACLPRNUINSUCNIHAH
EPSS
0.65%
47.2th percentile
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | rails | — | — |
| rails | activestorage | < 7.2.3.1 | 7.2.3.1 |
| rails | activestorage | — | — |
| rails | activestorage | — | — |
| rails | activestorage | >= 0 < 7.2.3.1 | 7.2.3.1 |
| rails | activestorage | >= 8.0.0.beta1 < 8.0.4.1 | 8.0.4.1 |
| rails | activestorage | >= 8.1.0.beta1 < 8.1.2.1 | 8.1.2.1 |
| rubyonrails | rails | < 7.2.3.1 | 7.2.3.1 |
| rubyonrails | rails | >= 8.0.0 < 8.0.4.1 | 8.0.4.1 |
| rubyonrails | rails | >= 8.1.0 < 8.1.2.1 | 8.1.2.1 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
nvdv4.06.6MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv6.6MEDIUM
vendor_debian6.6MEDIUM
vendor_redhat6.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
rails: Active Storage: Unintended file deletion via crafted blob keys
vendor_redhat·2026-03-23·CVSS 6.6
CVE-2026-33202 [MEDIUM] CWE-22 rails: Active Storage: Unintended file deletion via crafted blob keys
rails: Active Storage: Unintended file deletion via crafted blob keys
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
A flaw was found in Active Storage, a component of Rails applications. This vulnerability occurs because Active Storage's `DiskService#delete_prefixed` function does not properly escape glob metacharacters when processing blob keys. A remote
Debian
CVE-2026-33202: rails - Active Storage allows users to attach cloud and local files in Rails application...
vendor_debian·2026·CVSS 6.6
CVE-2026-33202 [MEDIUM] CVE-2026-33202: rails - Active Storage allows users to attach cloud and local files in Rails application...
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
OSV
CVE-2026-33202: Active Storage allows users to attach cloud and local files in Rails applications
osv·2026-03-24·CVSS 6.6
CVE-2026-33202 [MEDIUM] CVE-2026-33202: Active Storage allows users to attach cloud and local files in Rails applications
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
OSV
Rails Active Storage has possible glob injection in its DiskService
osv·2026-03-23
CVE-2026-33202 [MEDIUM] Rails Active Storage has possible glob injection in its DiskService
Rails Active Storage has possible glob injection in its DiskService
### Impact
Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory.
### Releases
The fixed releases are available at the normal locations.
GHSA
Rails Active Storage has possible glob injection in its DiskService
ghsa·2026-03-23
CVE-2026-33202 [MEDIUM] CWE-74 Rails Active Storage has possible glob injection in its DiskService
Rails Active Storage has possible glob injection in its DiskService
### Impact
Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory.
### Releases
The fixed releases are available at the normal locations.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-33202 rails: Active Storage: Unintended file deletion via crafted blob keys
bugzilla·2026-03-24·CVSS 6.6
CVE-2026-33202 [MEDIUM] CVE-2026-33202 rails: Active Storage: Unintended file deletion via crafted blob keys
CVE-2026-33202 rails: Active Storage: Unintended file deletion via crafted blob keys
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Wiz
CVE-2026-33202 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 4.8
CVE-2026-33202 [MEDIUM] CVE-2026-33202 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-33202 :
Ruby vulnerability analysis and mitigation
DiskService#delete_prefixed
Dir.glob
Source : NVD
## 6.6
Score
Published March 24, 2026
Severity MEDIUM
CNA Score 6.6
Affected Technologies
Ruby
Rails
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 7.1
Exploitation Probability (EPSS) N/A
Affected packages and libraries
rails
cpe:2.3:a:rubyonrails:rails
Sources
Chainguard Has Fix Added at: Mar 25, 2026
Debian 11, 14 Severity CRITICAL No Fix Added at: Mar 26, 2026
Debian 12, 13 Severity MEDIUM No Fix Added at: Mar 26, 2026
Echo Severity CRITICAL No Fix Added at: Mar 26, 2026
RubyGems Severity MEDIUM Has Fix Added at: Mar 24, 2026
Linux Severity CRITICAL Has Fix
https://github.com/rails/rails/commit/8c9676b803820110548cdb7523800db43bc6874chttps://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccfhttps://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82https://github.com/rails/rails/releases/tag/v7.2.3.1https://github.com/rails/rails/releases/tag/v8.0.4.1https://github.com/rails/rails/releases/tag/v8.1.2.1https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m
2026-03-24
Published