Skip to content
OpenAdvisories

Package · RubyGems

activerecord-tenanted

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Low —
    GHSA-pmwx-rm49-xv39

    ActiveRecord::Tenanted::Storage::DiskService#path_for has a possible path traversal

    ### Summary Active Record Tenanted's override of Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it …

    activerecord-tenanted RubyGems