CVE-2026-33173
Active Storage allows users to attach cloud and local files in Rails applications.
Published Mar 24, 2026 · updated Jun 17, 2026 · rubyonrails rails
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like and are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe , bypassing any validations that rely on Active Storage's automatic content type identification. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 24, 2026 · NIST NVD
Detected
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like and are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary co
Jun 17, 2026 · NIST NVD
Updated
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like and are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary co
Affected
- cpe rubyonrails/railsversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33173
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33173
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like and `anal
nvd.nist.gov