Skip to content
OpenAdvisories

Product · rails

activestorage

6 known vulnerabilities.

activestorage at a glance

Last 12 months
6
Critical · all time
1
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 1 vulnerability, 1 critical February 2026: 0 vulnerabilities March 2026: 5 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202650
Feb 202600
Jan 202611
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400
All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • Low 2.3
    CVE-2026-33658

    Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests

    Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of …

    rails activestorage rails rails Debian Ubuntu RubyGems
  • Medium 6.6
    CVE-2026-33202

    Rails Active Storage has possible glob injection in its DiskService

    Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If…

    rails activestorage rails rails Debian Ubuntu Wolfi RubyGems
  • High 8.0
    CVE-2026-33195

    Rails Active Storage has possible Path Traversal in DiskService

    Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root dir…

    rails activestorage rails rails Debian Ubuntu Wolfi RubyGems
  • Medium 6.6
    CVE-2026-33174

    Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

    Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage's proxy delivery mode, the proxy controller loads the entire requested byte range int…

    rails activestorage rails rails Debian Ubuntu Wolfi RubyGems
  • Medium 5.3
    CVE-2026-33173

    Rails Active Storage has possible content type bypass via metadata in direct uploads

    Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `…

    rails activestorage rails rails Debian Ubuntu Wolfi RubyGems
  • Critical 9.2
    CVE-2025-24293 Public exploit

    Active Storage allowed transformation methods that were potentially unsafe

    # Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default. The default allowed list contains three methods allow for the circumven…

    rails activestorage rails rails Debian Ubuntu RubyGems