CVE-2026-33195
Active Storage allows users to attach cloud and local files in Rails applications.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.57%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
- CVSS 4.0
- 8.0 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.57% probability · 45th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- rubyonrails/rails
- Source
- security-advisories@github.com
References
- https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2cPatch
- https://github.com/rails/rails/commit/9b06fbc0f504b8afe333f33d19548f3b85fbe655Patch
- https://github.com/rails/rails/commit/a290c8a1ec189d793aa6d7f2570b6a763f675348Patch
- https://github.com/rails/rails/releases/tag/v7.2.3.1Release Notes
- https://github.com/rails/rails/releases/tag/v8.0.4.1Release Notes
- https://github.com/rails/rails/releases/tag/v8.1.2.1Release Notes
- https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-33195
- https://bugzilla.redhat.com/show_bug.cgi?id=2450546
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33195.json
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.