Skip to content
OpenAdvisories

Package · RubyGems

activestorage

18 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.8
    CVE-2026-126186

    Active Storage: Possible arbitrary file read and remote code execution in Active Storage video previews, analysis and image processing

    Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Blob#open writes a blob to a tempfile whose name carries the extension of the uploaded…

    rails rails rails rails Debian Ubuntu RubyGems
  • High 8.0
    CVE-2026-33195

    Rails Active Storage has possible Path Traversal in DiskService

    Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root dir…

    rails activestorage rails rails Debian Ubuntu Wolfi RubyGems
  • High 7.5
    CVE-2020-8162 Public exploit

    Circumvention of file size limits in ActiveStorage

    A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user bypassing upload limits.

    rails rails activestorage Debian Ubuntu RubyGems