{"cve":"CVE-2026-33195","nvd":{"published":"2026-03-24T00:16:28.987","modified":"2026-07-15T02:20:09.497","status":"Modified","description":"Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","score":8.0},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-22"],"references":["https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c","https://github.com/rails/rails/commit/9b06fbc0f504b8afe333f33d19548f3b85fbe655","https://github.com/rails/rails/commit/a290c8a1ec189d793aa6d7f2570b6a763f675348","https://github.com/rails/rails/releases/tag/v7.2.3.1","https://github.com/rails/rails/releases/tag/v8.0.4.1"],"products":["rubyonrails:rails"],"source":"nvd","synced_at":"2026-10-19T22:26:19.218427112+00:00"},"epss":{"cve":"CVE-2026-33195","score":0.00577,"percentile":0.47568,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-9xrj-h377-fr87","url":"https://osv.dev/vulnerability/GHSA-9xrj-h377-fr87","summary":"Rails Active Storage has possible Path Traversal in DiskService","modified":"2026-09-10T03:51:00.286780824Z","packages":[{"ecosystem":"RubyGems","name":"activestorage","purl":"pkg:gem/activestorage","ranges":[">=8.1.0.beta1 <8.1.2.1"],"fixed":["8.1.2.1"]},{"ecosystem":"RubyGems","name":"activestorage","purl":"pkg:gem/activestorage","ranges":[">=8.0.0.beta1 <8.0.4.1"],"fixed":["8.0.4.1"]},{"ecosystem":"RubyGems","name":"activestorage","purl":"pkg:gem/activestorage","ranges":["<7.2.3.1"],"fixed":["7.2.3.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}