CVE-2026-33195
Active Storage allows users to attach cloud and local files in Rails applications.
Published Mar 24, 2026 · updated Jul 15, 2026 · rubyonrails rails
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. ) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 24, 2026 · NIST NVD
Detected
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. ) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are
Jul 15, 2026 · NIST NVD
Updated
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. ) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are
Affected
- cpe rubyonrails/railsversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33195
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33195
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's does not validate that the resolved filesystem path remains within the storage root directory. If a blob key
nvd.nist.gov