Rails Activestorage vulnerabilities

CVE-2026-33195 [CRITICAL] CWE-22 CVE-2026-33195: Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could al

CVE-2025-24293 [HIGH] CWE-77 CVE-2025-24293: # Active Storage allowed transformation methods potentially unsafe Active Storage attempts to pre # Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default. The default allowed list contains three methods allow for the circumvention of the safe defaults which enables potential command injection vulnerabilities in cases whe

CVE-2022-21831 [CRITICAL] CWE-94 Possible code injection vulnerability in Rails / Active Storage Possible code injection vulnerability in Rails / Active Storage The Active Storage module of Rails starting with version 5.2.0 is possibly vulnerable to code injection. This issue was patched in versions 5.2.6.3, 6.0.4.7, 6.1.4.7, and 7.0.2.3. To work around this issue, applications should implement a strict allow-list on accepted transformation methods or arguments. Additionally, a strict ImageMagi

CVE-2026-33202 [CRITICAL] CWE-74 CVE-2026-33202: Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metachara

CVE-2026-33174 [HIGH] CWE-789 CVE-2026-33174: Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`)

CVE-2020-8162 [HIGH] CWE-434 Circumvention of file size limits in ActiveStorage Circumvention of file size limits in ActiveStorage There is a vulnerability in ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user. Versions Affected: rails = 5.2.4.3, rails >= 6.0.3.1 Impact Utilizing this vulnerability, an attacker can control the Content-Length of an S3 direct upload URL without receiving a new signature from the server. This could be

CVE-2026-33658 [MEDIUM] CWE-770 CVE-2026-33658: Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same fil

CVE-2026-33173 [MEDIUM] CWE-925 CVE-2026-33173: Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a direct-upload client can

CVE-2018-16477 [MEDIUM] CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in activestorage Exposure of Sensitive Information to an Unauthorized Actor in activestorage A bypass vulnerability in Active Storage >= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the `content-disposition` and `content-type` parameters which can be used in with HTML files and have them executed inline. Additionally, if combined with other techniques such as cookie bombing

CVE-2024-26144 [MEDIUM] CWE-200 Rails has possible Sensitive Session Information Leak in Active Storage Rails has possible Sensitive Session Information Leak in Active Storage # Possible Sensitive Session Information Leak in Active Storage There is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a `Set-Cookie` header along with the user's session cookie when serving blobs. It also sets `Cache-Control` to public. Certain proxies may cache the Se