{"cve":"CVE-2026-33202","nvd":{"published":"2026-03-24T00:16:29.157","modified":"2026-06-17T10:37:06.847","status":"Analyzed","description":"Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U","score":6.6},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","score":9.1},"cwes":["CWE-74"],"references":["https://github.com/rails/rails/commit/8c9676b803820110548cdb7523800db43bc6874c","https://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccf","https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82","https://github.com/rails/rails/releases/tag/v7.2.3.1","https://github.com/rails/rails/releases/tag/v8.0.4.1"],"products":["rubyonrails:rails"],"source":"nvd","synced_at":"2026-10-19T22:26:19.218427112+00:00"},"epss":{"cve":"CVE-2026-33202","score":0.00672,"percentile":0.52071,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-73f9-jhhh-hr5m","url":"https://osv.dev/vulnerability/GHSA-73f9-jhhh-hr5m","summary":"Rails Active Storage has possible glob injection in its DiskService","modified":"2026-09-10T03:50:37.852072581Z","packages":[{"ecosystem":"RubyGems","name":"activestorage","purl":"pkg:gem/activestorage","ranges":[">=8.1.0.beta1 <8.1.2.1"],"fixed":["8.1.2.1"]},{"ecosystem":"RubyGems","name":"activestorage","purl":"pkg:gem/activestorage","ranges":[">=8.0.0.beta1 <8.0.4.1"],"fixed":["8.0.4.1"]},{"ecosystem":"RubyGems","name":"activestorage","purl":"pkg:gem/activestorage","ranges":["<7.2.3.1"],"fixed":["7.2.3.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}