Skip to content
OpenAdvisories
High WID-SEC-2026-0833 10 CVEs

Ruby on Rails: Mehrere Schwachstellen

Published Mar 23, 2026 · Updated Oct 8, 2026 · Revision 6 · de-DE

Vendor: Debian Vendor: HCL Software Vendor: Red Hat Product: BigFix Product: Enterprise Linux Product: Linux Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um einen Denial of Service Angriff durchzuführen, um Dateien zu manipulieren, und um einen Cross-Site Scripting Angriff durchzuführen.

Product

Ruby on Rails ist ein in der Programmiersprache Ruby geschriebenes und quelloffenes Web Application Framework.

Vulnerabilities 10

  • High 8.0
    CVE-2026-33195

    Rails Active Storage has possible Path Traversal in DiskService

    Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root dir…

    rails activestorage rails rails Debian Ubuntu Wolfi RubyGems
  • Medium 6.9
    CVE-2026-33169

    Rails Active Support has a possible ReDoS vulnerability in number_to_delimited

    Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. `NumberToDelimitedConverter` uses a lookahead-based regular expression with `gsub!` to insert thousands delimiters. Prior to versions 8.1.2.1, 8.0.4.…

    rails activesupport rails kube-fluentd-operator Debian Ubuntu Wolfi RubyGems
  • Medium 6.6
    CVE-2026-33174

    Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

    Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range int…

    rails activestorage rails rails Debian Ubuntu Wolfi RubyGems
  • Medium 6.6
    CVE-2026-33176

    Rails Active Support has a possible DoS vulnerability in its number helpers

    Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`), which …

    rails activesupport rails kube-fluentd-operator Debian Ubuntu Wolfi RubyGems
  • Medium 6.6
    CVE-2026-33202

    Rails Active Storage has possible glob injection in its DiskService

    Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If…

    rails activestorage rails rails Debian Ubuntu Wolfi RubyGems
  • Medium 5.3
    CVE-2026-33170

    Rails Active Support has a possible XSS vulnerability in SafeBuffer#%

    Active Support is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuf…

    rails activesupport rails kube-fluentd-operator Debian Ubuntu Wolfi RubyGems
  • Medium 5.3
    CVE-2026-33173

    Rails Active Storage has possible content type bypass via metadata in direct uploads

    Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `…

    rails activestorage rails rails Debian Ubuntu Wolfi RubyGems
  • Low 2.3
    CVE-2026-33168

    Rails has a possible XSS vulnerability in its Action View tag helpers

    Action View provides conventions and helpers for building web pages with the Rails framework. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed…

    rails actionview rails rails Debian Ubuntu Wolfi RubyGems
  • Low 2.3
    CVE-2026-33658

    Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests

    Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of …

    rails activestorage rails rails Debian Ubuntu RubyGems
  • Low 1.3
    CVE-2026-33167

    Rails has a possible XSS vulnerability in its Action Pack debug exceptions

    Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary …

    rails actionpack rails actionpack Ubuntu Wolfi RubyGems

Revision history

  1. #6

    Neue Updates von Debian aufgenommen

  2. #5

    Neue Updates von Debian aufgenommen

  3. #4

    Neue Updates von HCL aufgenommen

  4. #3

    Neue Updates von Red Hat aufgenommen

  5. #2

    Referenz(en) aufgenommen: EUVD-2026-16426

  6. #1

    Initiale Fassung

References