Critical severity · published Mar 23, 2026
CVE-2026-33195
Rails Active Storage has possible Path Traversal in DiskService
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
activestorage · rails
>= 8.1.0.beta1, < 8.1.2.1; >= 8.0.0.beta1, < 8.0.4.1; < 7.2.3.1 · source: vendor
RA
Rails · Rubyonrails
before 7.2.3.1; 8.0.0 before 8.0.4.1; 8.1.0 before 8.1.2.1 · source: NVD
RH
Red Hat 3scale API Management Platform 2 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33195
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-33195
Patch
https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c
Patch
https://github.com/rails/rails/commit/9b06fbc0f504b8afe333f33d19548f3b85fbe655
Patch
https://github.com/rails/rails/commit/a290c8a1ec189d793aa6d7f2570b6a763f675348
Release Notes
https://github.com/rails/rails/releases/tag/v7.2.3.1
Release Notes
https://github.com/rails/rails/releases/tag/v8.0.4.1
Release Notes
https://github.com/rails/rails/releases/tag/v8.1.2.1
More from activestorage
9.1
CVE-2026-33202
Rails Active Storage has possible glob injection in its DiskService
8.1
CVE-2025-24293
# Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters…
7.5
CVE-2026-33174
Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests
6.5
CVE-2026-33658
Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests
5.3
CVE-2026-33173
Rails Active Storage has possible content type bypass via metadata in direct uploads