Search
Find a vulnerability
Search criteria
12 vulnerabilities found for activestorage by rails
CVE-2026-33658 (GCVE-0-2026-33658)
Vulnerability from nvd – Published: 2026-03-26 21:03 – Updated: 2026-03-30 11:42
VLAI
EPSS
VEX
Title
Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests
Summary
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1
Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
| https://github.com/rubysec/ruby-advisory-db/blob/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rails | activestorage |
Affected:
>= 8.1.0, < 8.1.2.1
Affected: >= 8.0.0, < 8.0.4.1 Affected: < 7.2.3.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33658",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-30T11:42:16.532847Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-30T11:42:24.885Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "activestorage",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1\nActive Storage\u0027s proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-26T21:03:25.319Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-p9fm-f462-ggrg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-p9fm-f462-ggrg"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
},
{
"name": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-33658.yml",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-33658.yml"
}
],
"source": {
"advisory": "GHSA-p9fm-f462-ggrg",
"discovery": "UNKNOWN"
},
"title": "Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33658",
"datePublished": "2026-03-26T21:03:25.319Z",
"dateReserved": "2026-03-23T15:23:42.219Z",
"dateUpdated": "2026-03-30T11:42:24.885Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33202 (GCVE-0-2026-33202)
Vulnerability from nvd – Published: 2026-03-23 23:34 – Updated: 2026-03-24 15:44
VLAI
EPSS
VEX
Title
Rails Active Storage has possible glob injection in its DiskService
Summary
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/8c9676b8038… | x_refsource_MISC |
| https://github.com/rails/rails/commit/955284d26e4… | x_refsource_MISC |
| https://github.com/rails/rails/commit/fa190735463… | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rails | activestorage |
Affected:
>= 8.1.0.beta1, < 8.1.2.1
Affected: >= 8.0.0.beta1, < 8.0.4.1 Affected: < 7.2.3.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33202",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T15:42:33.496549Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T15:44:19.018Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "activestorage",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0.beta1, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0.beta1, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage\u0027s `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T23:34:52.715Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m"
},
{
"name": "https://github.com/rails/rails/commit/8c9676b803820110548cdb7523800db43bc6874c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/8c9676b803820110548cdb7523800db43bc6874c"
},
{
"name": "https://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccf"
},
{
"name": "https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
}
],
"source": {
"advisory": "GHSA-73f9-jhhh-hr5m",
"discovery": "UNKNOWN"
},
"title": "Rails Active Storage has possible glob injection in its DiskService"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33202",
"datePublished": "2026-03-23T23:34:52.715Z",
"dateReserved": "2026-03-17T23:23:58.312Z",
"dateUpdated": "2026-03-24T15:44:19.018Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33195 (GCVE-0-2026-33195)
Vulnerability from nvd – Published: 2026-03-23 23:31 – Updated: 2026-06-30 12:07
VLAI
EPSS
VEX
Title
Rails Active Storage has possible Path Traversal in DiskService
Summary
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/4933c1e3b8c… | x_refsource_MISC |
| https://github.com/rails/rails/commit/9b06fbc0f50… | x_refsource_MISC |
| https://github.com/rails/rails/commit/a290c8a1ec1… | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
| https://access.redhat.com/security/cve/CVE-2026-33195 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2450546 | issue-trackingx_refsource_REDHAT |
| https://security.access.redhat.com/data/csaf/v2/v… | x_sadp-csaf-vex |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| rails | activestorage |
Affected:
>= 8.1.0.beta1, < 8.1.2.1
Affected: >= 8.0.0.beta1, < 8.0.4.1 Affected: < 7.2.3.1 |
|
| Red Hat | Red Hat 3scale API Management Platform 2 |
cpe:/a:redhat:red_hat_3scale_amp:2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33195",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T03:56:06.239Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
}
],
"datePublic": "2026-03-23T23:31:41.785Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Active Storage, a component of Rails applications that manages file attachments. This vulnerability allows an attacker to manipulate file paths by using specially crafted input in blob keys. This manipulation can lead to unauthorized reading, writing, or deletion of arbitrary files on the server, potentially compromising the integrity and confidentiality of data."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T12:07:37.905Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-33195"
},
{
"name": "RHBZ#2450546",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450546"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33195.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-24T00:01:50.330Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-03-23T23:31:41.785Z",
"value": "Made public."
}
],
"title": "Rails: Active Storage: Active Storage (Rails): Arbitrary file access via path traversal in blob keys",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, ensure that blob keys used by Active Storage are not derived from untrusted user input. Applications should validate and sanitize any user-provided data before it is used in blob keys to prevent path traversal sequences."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "activestorage",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0.beta1, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0.beta1, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage\u0027s `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T23:31:41.785Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87"
},
{
"name": "https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c"
},
{
"name": "https://github.com/rails/rails/commit/9b06fbc0f504b8afe333f33d19548f3b85fbe655",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/9b06fbc0f504b8afe333f33d19548f3b85fbe655"
},
{
"name": "https://github.com/rails/rails/commit/a290c8a1ec189d793aa6d7f2570b6a763f675348",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/a290c8a1ec189d793aa6d7f2570b6a763f675348"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
}
],
"source": {
"advisory": "GHSA-9xrj-h377-fr87",
"discovery": "UNKNOWN"
},
"title": "Rails Active Storage has possible Path Traversal in DiskService"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33195",
"datePublished": "2026-03-23T23:31:41.785Z",
"dateReserved": "2026-03-17T22:16:36.721Z",
"dateUpdated": "2026-06-30T12:07:37.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33174 (GCVE-0-2026-33174)
Vulnerability from nvd – Published: 2026-03-23 23:24 – Updated: 2026-03-24 13:40
VLAI
EPSS
VEX
Title
Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests
Summary
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/2cd933c366b… | x_refsource_MISC |
| https://github.com/rails/rails/commit/42012eaaa88… | x_refsource_MISC |
| https://github.com/rails/rails/commit/8159a9c3de3… | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rails | activestorage |
Affected:
>= 8.1.0.beta1, < 8.1.2.1
Affected: >= 8.0.0.beta1, < 8.0.4.1 Affected: < 7.2.3.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33174",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T13:40:23.185319Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T13:40:32.031Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "activestorage",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0.beta1, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0.beta1, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage\u0027s proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T23:25:23.363Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-r46p-8f7g-vvvg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-r46p-8f7g-vvvg"
},
{
"name": "https://github.com/rails/rails/commit/2cd933c366b777f873d4d590127da2f4a25e4ba5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/2cd933c366b777f873d4d590127da2f4a25e4ba5"
},
{
"name": "https://github.com/rails/rails/commit/42012eaaa88dfc7d0030161b2bc8074a7bbce92a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/42012eaaa88dfc7d0030161b2bc8074a7bbce92a"
},
{
"name": "https://github.com/rails/rails/commit/8159a9c3de3f27a2bcf2866b8bf9ceb9075e229b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/8159a9c3de3f27a2bcf2866b8bf9ceb9075e229b"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
}
],
"source": {
"advisory": "GHSA-r46p-8f7g-vvvg",
"discovery": "UNKNOWN"
},
"title": "Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33174",
"datePublished": "2026-03-23T23:24:55.594Z",
"dateReserved": "2026-03-17T22:16:36.719Z",
"dateUpdated": "2026-03-24T13:40:32.031Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33173 (GCVE-0-2026-33173)
Vulnerability from nvd – Published: 2026-03-23 23:21 – Updated: 2026-03-24 15:12
VLAI
EPSS
VEX
Title
Rails Active Storage has possible content type bypass via metadata in direct uploads
Summary
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe `content_type`, bypassing any validations that rely on Active Storage's automatic content type identification. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-925 - Improper Verification of Intent by Broadcast Receiver
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/707c0f1f41f… | x_refsource_MISC |
| https://github.com/rails/rails/commit/8fcb934caad… | x_refsource_MISC |
| https://github.com/rails/rails/commit/d9502f5214e… | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rails | activestorage |
Affected:
>= 8.1.0.beta1, < 8.1.2.1
Affected: >= 8.0.0.beta1, < 8.0.4.1 Affected: < 7.2.3.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33173",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T14:14:22.499615Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T15:12:50.569Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "activestorage",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0.beta1, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0.beta1, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe `content_type`, bypassing any validations that rely on Active Storage\u0027s automatic content type identification. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-925",
"description": "CWE-925: Improper Verification of Intent by Broadcast Receiver",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T23:21:29.843Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg"
},
{
"name": "https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53"
},
{
"name": "https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e"
},
{
"name": "https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
}
],
"source": {
"advisory": "GHSA-qcfx-2mfw-w4cg",
"discovery": "UNKNOWN"
},
"title": "Rails Active Storage has possible content type bypass via metadata in direct uploads"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33173",
"datePublished": "2026-03-23T23:21:29.843Z",
"dateReserved": "2026-03-17T22:16:36.719Z",
"dateUpdated": "2026-03-24T15:12:50.569Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-24293 (GCVE-0-2025-24293)
Vulnerability from nvd – Published: 2026-01-30 20:11 – Updated: 2026-06-30 12:07
VLAI
EPSS
VEX
Summary
# Active Storage allowed transformation methods potentially unsafe
Active Storage attempts to prevent the use of potentially unsafe image
transformation methods and parameters by default.
The default allowed list contains three methods allow for the circumvention
of the safe defaults which enables potential command injection
vulnerabilities in cases where arbitrary user supplied input is accepted as
valid transformation methods or parameters.
Impact
------
This vulnerability impacts applications that use Active Storage with the image_processing processing gem in addition to mini_magick as the image processor.
Vulnerable code will look something similar to this:
```
<%= image_tag blob.variant(params[:t] => params[:v]) %>
```
Where the transformation method or its arguments are untrusted arbitrary input.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Workarounds
-----------
Consuming user supplied input for image transformation methods or their parameters is unsupported behavior and should be considered dangerous.
Strict validation of user supplied methods and parameters should be performed
as well as having a strong [ImageMagick security
policy](https://imagemagick.org/script/security-policy.php) deployed.
Credits
-------
Thank you [lio346](https://hackerone.com/lio346) for reporting this!
Severity
8.1 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/advisories/GHSA-r4mg-4433-c7g3 | |
| https://access.redhat.com/security/cve/CVE-2025-24293 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2435565 | issue-trackingx_refsource_REDHAT |
| https://security.access.redhat.com/data/csaf/v2/v… | x_sadp-csaf-vex |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Rails | activestorage |
Affected:
5.2 , < 5.*
(semver)
Affected: 7.0 , < 7.1.5.2 (semver) Affected: 8.0 , < 7.0.2.1 (semver) |
|
| Red Hat | Red Hat 3scale API Management Platform 2 |
cpe:/a:redhat:red_hat_3scale_amp:2 |
|
| Red Hat | Red Hat Satellite 6 |
cpe:/a:redhat:satellite:6 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-24293",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-02T14:45:32.482487Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-02T14:47:12.620Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "unaffected",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
}
],
"datePublic": "2026-01-30T20:11:15.219Z",
"descriptions": [
{
"lang": "en",
"value": "Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default. The default allowed list contains three methods allowing for the circumvention of the safe defaults which enables potential command injection vulnerabilities in cases where arbitrary user supplied input is accepted as valid transformation methods or parameters. This vulnerability impacts applications that use Active Storage with the image_processing processing gem in addition to mini_magick as the image processor."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T12:07:21.225Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2025-24293"
},
{
"name": "RHBZ#2435565",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2435565"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-24293.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-01-30T21:01:14.441Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-01-30T20:11:15.219Z",
"value": "Made public."
}
],
"title": "activestorage: Code injection in Active Storage when used in conjunction with the image_processing gem",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "activestorage",
"vendor": "Rails",
"versions": [
{
"lessThan": "5.*",
"status": "affected",
"version": "5.2",
"versionType": "semver"
},
{
"lessThan": "7.1.5.2",
"status": "affected",
"version": "7.0",
"versionType": "semver"
},
{
"lessThan": "7.0.2.1",
"status": "affected",
"version": "8.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "# Active Storage allowed transformation methods potentially unsafe\r\n\r\nActive Storage attempts to prevent the use of potentially unsafe image\r\ntransformation methods and parameters by default.\r\n\r\nThe default allowed list contains three methods allow for the circumvention\r\nof the safe defaults which enables potential command injection\r\nvulnerabilities in cases where arbitrary user supplied input is accepted as\r\nvalid transformation methods or parameters.\r\n\r\n\r\nImpact\r\n------\r\nThis vulnerability impacts applications that use Active Storage with the image_processing processing gem in addition to mini_magick as the image processor.\r\n\r\nVulnerable code will look something similar to this:\r\n```\r\n\u003c%= image_tag blob.variant(params[:t] =\u003e params[:v]) %\u003e\r\n```\r\n\r\nWhere the transformation method or its arguments are untrusted arbitrary input.\r\n\r\nAll users running an affected release should either upgrade or use one of the workarounds immediately.\r\n\r\n\r\n\r\nWorkarounds\r\n-----------\r\nConsuming user supplied input for image transformation methods or their parameters is unsupported behavior and should be considered dangerous.\r\n\r\nStrict validation of user supplied methods and parameters should be performed\r\nas well as having a strong [ImageMagick security\r\npolicy](https://imagemagick.org/script/security-policy.php) deployed.\r\n\r\nCredits\r\n-------\r\n\r\nThank you [lio346](https://hackerone.com/lio346) for reporting this!"
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-30T20:11:15.219Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://github.com/advisories/GHSA-r4mg-4433-c7g3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-24293",
"datePublished": "2026-01-30T20:11:15.219Z",
"dateReserved": "2025-01-17T01:00:07.458Z",
"dateUpdated": "2026-06-30T12:07:21.225Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33658 (GCVE-0-2026-33658)
Vulnerability from cvelistv5 – Published: 2026-03-26 21:03 – Updated: 2026-03-30 11:42
VLAI
EPSS
VEX
Title
Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests
Summary
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1
Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
| https://github.com/rubysec/ruby-advisory-db/blob/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rails | activestorage |
Affected:
>= 8.1.0, < 8.1.2.1
Affected: >= 8.0.0, < 8.0.4.1 Affected: < 7.2.3.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33658",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-30T11:42:16.532847Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-30T11:42:24.885Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "activestorage",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1\nActive Storage\u0027s proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-26T21:03:25.319Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-p9fm-f462-ggrg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-p9fm-f462-ggrg"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
},
{
"name": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-33658.yml",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-33658.yml"
}
],
"source": {
"advisory": "GHSA-p9fm-f462-ggrg",
"discovery": "UNKNOWN"
},
"title": "Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33658",
"datePublished": "2026-03-26T21:03:25.319Z",
"dateReserved": "2026-03-23T15:23:42.219Z",
"dateUpdated": "2026-03-30T11:42:24.885Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33202 (GCVE-0-2026-33202)
Vulnerability from cvelistv5 – Published: 2026-03-23 23:34 – Updated: 2026-03-24 15:44
VLAI
EPSS
VEX
Title
Rails Active Storage has possible glob injection in its DiskService
Summary
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/8c9676b8038… | x_refsource_MISC |
| https://github.com/rails/rails/commit/955284d26e4… | x_refsource_MISC |
| https://github.com/rails/rails/commit/fa190735463… | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rails | activestorage |
Affected:
>= 8.1.0.beta1, < 8.1.2.1
Affected: >= 8.0.0.beta1, < 8.0.4.1 Affected: < 7.2.3.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33202",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T15:42:33.496549Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T15:44:19.018Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "activestorage",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0.beta1, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0.beta1, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage\u0027s `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T23:34:52.715Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m"
},
{
"name": "https://github.com/rails/rails/commit/8c9676b803820110548cdb7523800db43bc6874c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/8c9676b803820110548cdb7523800db43bc6874c"
},
{
"name": "https://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccf"
},
{
"name": "https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
}
],
"source": {
"advisory": "GHSA-73f9-jhhh-hr5m",
"discovery": "UNKNOWN"
},
"title": "Rails Active Storage has possible glob injection in its DiskService"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33202",
"datePublished": "2026-03-23T23:34:52.715Z",
"dateReserved": "2026-03-17T23:23:58.312Z",
"dateUpdated": "2026-03-24T15:44:19.018Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33195 (GCVE-0-2026-33195)
Vulnerability from cvelistv5 – Published: 2026-03-23 23:31 – Updated: 2026-06-30 12:07
VLAI
EPSS
VEX
Title
Rails Active Storage has possible Path Traversal in DiskService
Summary
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/4933c1e3b8c… | x_refsource_MISC |
| https://github.com/rails/rails/commit/9b06fbc0f50… | x_refsource_MISC |
| https://github.com/rails/rails/commit/a290c8a1ec1… | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
| https://access.redhat.com/security/cve/CVE-2026-33195 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2450546 | issue-trackingx_refsource_REDHAT |
| https://security.access.redhat.com/data/csaf/v2/v… | x_sadp-csaf-vex |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| rails | activestorage |
Affected:
>= 8.1.0.beta1, < 8.1.2.1
Affected: >= 8.0.0.beta1, < 8.0.4.1 Affected: < 7.2.3.1 |
|
| Red Hat | Red Hat 3scale API Management Platform 2 |
cpe:/a:redhat:red_hat_3scale_amp:2 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33195",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T03:56:06.239Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
}
],
"datePublic": "2026-03-23T23:31:41.785Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Active Storage, a component of Rails applications that manages file attachments. This vulnerability allows an attacker to manipulate file paths by using specially crafted input in blob keys. This manipulation can lead to unauthorized reading, writing, or deletion of arbitrary files on the server, potentially compromising the integrity and confidentiality of data."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T12:07:37.905Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-33195"
},
{
"name": "RHBZ#2450546",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450546"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33195.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-24T00:01:50.330Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-03-23T23:31:41.785Z",
"value": "Made public."
}
],
"title": "Rails: Active Storage: Active Storage (Rails): Arbitrary file access via path traversal in blob keys",
"workarounds": [
{
"lang": "en",
"value": "To mitigate this issue, ensure that blob keys used by Active Storage are not derived from untrusted user input. Applications should validate and sanitize any user-provided data before it is used in blob keys to prevent path traversal sequences."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "activestorage",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0.beta1, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0.beta1, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage\u0027s `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T23:31:41.785Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87"
},
{
"name": "https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c"
},
{
"name": "https://github.com/rails/rails/commit/9b06fbc0f504b8afe333f33d19548f3b85fbe655",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/9b06fbc0f504b8afe333f33d19548f3b85fbe655"
},
{
"name": "https://github.com/rails/rails/commit/a290c8a1ec189d793aa6d7f2570b6a763f675348",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/a290c8a1ec189d793aa6d7f2570b6a763f675348"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
}
],
"source": {
"advisory": "GHSA-9xrj-h377-fr87",
"discovery": "UNKNOWN"
},
"title": "Rails Active Storage has possible Path Traversal in DiskService"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33195",
"datePublished": "2026-03-23T23:31:41.785Z",
"dateReserved": "2026-03-17T22:16:36.721Z",
"dateUpdated": "2026-06-30T12:07:37.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33174 (GCVE-0-2026-33174)
Vulnerability from cvelistv5 – Published: 2026-03-23 23:24 – Updated: 2026-03-24 13:40
VLAI
EPSS
VEX
Title
Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests
Summary
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/2cd933c366b… | x_refsource_MISC |
| https://github.com/rails/rails/commit/42012eaaa88… | x_refsource_MISC |
| https://github.com/rails/rails/commit/8159a9c3de3… | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rails | activestorage |
Affected:
>= 8.1.0.beta1, < 8.1.2.1
Affected: >= 8.0.0.beta1, < 8.0.4.1 Affected: < 7.2.3.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33174",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T13:40:23.185319Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T13:40:32.031Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "activestorage",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0.beta1, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0.beta1, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage\u0027s proxy delivery mode, the proxy controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789: Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T23:25:23.363Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-r46p-8f7g-vvvg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-r46p-8f7g-vvvg"
},
{
"name": "https://github.com/rails/rails/commit/2cd933c366b777f873d4d590127da2f4a25e4ba5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/2cd933c366b777f873d4d590127da2f4a25e4ba5"
},
{
"name": "https://github.com/rails/rails/commit/42012eaaa88dfc7d0030161b2bc8074a7bbce92a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/42012eaaa88dfc7d0030161b2bc8074a7bbce92a"
},
{
"name": "https://github.com/rails/rails/commit/8159a9c3de3f27a2bcf2866b8bf9ceb9075e229b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/8159a9c3de3f27a2bcf2866b8bf9ceb9075e229b"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
}
],
"source": {
"advisory": "GHSA-r46p-8f7g-vvvg",
"discovery": "UNKNOWN"
},
"title": "Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33174",
"datePublished": "2026-03-23T23:24:55.594Z",
"dateReserved": "2026-03-17T22:16:36.719Z",
"dateUpdated": "2026-03-24T13:40:32.031Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33173 (GCVE-0-2026-33173)
Vulnerability from cvelistv5 – Published: 2026-03-23 23:21 – Updated: 2026-03-24 15:12
VLAI
EPSS
VEX
Title
Rails Active Storage has possible content type bypass via metadata in direct uploads
Summary
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe `content_type`, bypassing any validations that rely on Active Storage's automatic content type identification. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-925 - Improper Verification of Intent by Broadcast Receiver
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/rails/rails/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/rails/rails/commit/707c0f1f41f… | x_refsource_MISC |
| https://github.com/rails/rails/commit/8fcb934caad… | x_refsource_MISC |
| https://github.com/rails/rails/commit/d9502f5214e… | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v7.2.3.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.0.4.1 | x_refsource_MISC |
| https://github.com/rails/rails/releases/tag/v8.1.2.1 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rails | activestorage |
Affected:
>= 8.1.0.beta1, < 8.1.2.1
Affected: >= 8.0.0.beta1, < 8.0.4.1 Affected: < 7.2.3.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33173",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T14:14:22.499615Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-24T15:12:50.569Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "activestorage",
"vendor": "rails",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.1.0.beta1, \u003c 8.1.2.1"
},
{
"status": "affected",
"version": "\u003e= 8.0.0.beta1, \u003c 8.0.4.1"
},
{
"status": "affected",
"version": "\u003c 7.2.3.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe `content_type`, bypassing any validations that rely on Active Storage\u0027s automatic content type identification. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-925",
"description": "CWE-925: Improper Verification of Intent by Broadcast Receiver",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T23:21:29.843Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg"
},
{
"name": "https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53"
},
{
"name": "https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e"
},
{
"name": "https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0"
},
{
"name": "https://github.com/rails/rails/releases/tag/v7.2.3.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.0.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
},
{
"name": "https://github.com/rails/rails/releases/tag/v8.1.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
}
],
"source": {
"advisory": "GHSA-qcfx-2mfw-w4cg",
"discovery": "UNKNOWN"
},
"title": "Rails Active Storage has possible content type bypass via metadata in direct uploads"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33173",
"datePublished": "2026-03-23T23:21:29.843Z",
"dateReserved": "2026-03-17T22:16:36.719Z",
"dateUpdated": "2026-03-24T15:12:50.569Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-24293 (GCVE-0-2025-24293)
Vulnerability from cvelistv5 – Published: 2026-01-30 20:11 – Updated: 2026-06-30 12:07
VLAI
EPSS
VEX
Summary
# Active Storage allowed transformation methods potentially unsafe
Active Storage attempts to prevent the use of potentially unsafe image
transformation methods and parameters by default.
The default allowed list contains three methods allow for the circumvention
of the safe defaults which enables potential command injection
vulnerabilities in cases where arbitrary user supplied input is accepted as
valid transformation methods or parameters.
Impact
------
This vulnerability impacts applications that use Active Storage with the image_processing processing gem in addition to mini_magick as the image processor.
Vulnerable code will look something similar to this:
```
<%= image_tag blob.variant(params[:t] => params[:v]) %>
```
Where the transformation method or its arguments are untrusted arbitrary input.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Workarounds
-----------
Consuming user supplied input for image transformation methods or their parameters is unsupported behavior and should be considered dangerous.
Strict validation of user supplied methods and parameters should be performed
as well as having a strong [ImageMagick security
policy](https://imagemagick.org/script/security-policy.php) deployed.
Credits
-------
Thank you [lio346](https://hackerone.com/lio346) for reporting this!
Severity
8.1 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/advisories/GHSA-r4mg-4433-c7g3 | |
| https://access.redhat.com/security/cve/CVE-2025-24293 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2435565 | issue-trackingx_refsource_REDHAT |
| https://security.access.redhat.com/data/csaf/v2/v… | x_sadp-csaf-vex |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Rails | activestorage |
Affected:
5.2 , < 5.*
(semver)
Affected: 7.0 , < 7.1.5.2 (semver) Affected: 8.0 , < 7.0.2.1 (semver) |
|
| Red Hat | Red Hat 3scale API Management Platform 2 |
cpe:/a:redhat:red_hat_3scale_amp:2 |
|
| Red Hat | Red Hat Satellite 6 |
cpe:/a:redhat:satellite:6 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-24293",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-02T14:45:32.482487Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-02T14:47:12.620Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "unaffected",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
}
],
"datePublic": "2026-01-30T20:11:15.219Z",
"descriptions": [
{
"lang": "en",
"value": "Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default. The default allowed list contains three methods allowing for the circumvention of the safe defaults which enables potential command injection vulnerabilities in cases where arbitrary user supplied input is accepted as valid transformation methods or parameters. This vulnerability impacts applications that use Active Storage with the image_processing processing gem in addition to mini_magick as the image processor."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-30T12:07:21.225Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2025-24293"
},
{
"name": "RHBZ#2435565",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2435565"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-24293.json"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-01-30T21:01:14.441Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-01-30T20:11:15.219Z",
"value": "Made public."
}
],
"title": "activestorage: Code injection in Active Storage when used in conjunction with the image_processing gem",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "activestorage",
"vendor": "Rails",
"versions": [
{
"lessThan": "5.*",
"status": "affected",
"version": "5.2",
"versionType": "semver"
},
{
"lessThan": "7.1.5.2",
"status": "affected",
"version": "7.0",
"versionType": "semver"
},
{
"lessThan": "7.0.2.1",
"status": "affected",
"version": "8.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "# Active Storage allowed transformation methods potentially unsafe\r\n\r\nActive Storage attempts to prevent the use of potentially unsafe image\r\ntransformation methods and parameters by default.\r\n\r\nThe default allowed list contains three methods allow for the circumvention\r\nof the safe defaults which enables potential command injection\r\nvulnerabilities in cases where arbitrary user supplied input is accepted as\r\nvalid transformation methods or parameters.\r\n\r\n\r\nImpact\r\n------\r\nThis vulnerability impacts applications that use Active Storage with the image_processing processing gem in addition to mini_magick as the image processor.\r\n\r\nVulnerable code will look something similar to this:\r\n```\r\n\u003c%= image_tag blob.variant(params[:t] =\u003e params[:v]) %\u003e\r\n```\r\n\r\nWhere the transformation method or its arguments are untrusted arbitrary input.\r\n\r\nAll users running an affected release should either upgrade or use one of the workarounds immediately.\r\n\r\n\r\n\r\nWorkarounds\r\n-----------\r\nConsuming user supplied input for image transformation methods or their parameters is unsupported behavior and should be considered dangerous.\r\n\r\nStrict validation of user supplied methods and parameters should be performed\r\nas well as having a strong [ImageMagick security\r\npolicy](https://imagemagick.org/script/security-policy.php) deployed.\r\n\r\nCredits\r\n-------\r\n\r\nThank you [lio346](https://hackerone.com/lio346) for reporting this!"
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-30T20:11:15.219Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://github.com/advisories/GHSA-r4mg-4433-c7g3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-24293",
"datePublished": "2026-01-30T20:11:15.219Z",
"dateReserved": "2025-01-17T01:00:07.458Z",
"dateUpdated": "2026-06-30T12:07:21.225Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}