CVE-2018-16477: activestorage - Exposure of Sensitive Information to an Unauthorized Actor
Summary
CVE-2018-16477: Exposure of Sensitive Information to an Unauthorized Actor in activestorage. Affects activestorage versions >= 5.2.0, < 5.2.1.1. Fixed in 5.2.1.1. How to fix ↓
Also tracked for
- rails · Debian:11
The same CVE-2018-16477 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Active Storage is a Ruby on Rails component that facilitates uploading and retrieving files to and from cloud storage services. It provides an abstraction layer for various storage services, including Google Cloud Storage (GCS) and Disk. This vulnerability affects Active Storage versions 5.2.0 to 5.2.1.0 when using GCS or Disk services in production.
Vulnerability Detail
The vulnerability allows an attacker to modify the content-disposition and content-type parameters, which can be used with HTML files to execute them inline. By combining this technique with other methods like cookie bombing and specially crafted AppCache manifests, an attacker can gain access to private signed URLs within a specific storage path. This can lead to unauthorized access to sensitive information.
How To Fix
Latest published version: 8.1.4 as of 22 Oct 2026
gem install activestorage -v 8.1.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.2.1.1
This is the first release that contains the fix.
gem install activestorage -v 5.2.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is essential to upgrade to the fixed version of Active Storage to mitigate the risk of exposure to sensitive information.
Conclusion
The exposure of sensitive information vulnerability in Active Storage versions 5.2.0 to 5.2.1.0 can lead to unauthorized access to private signed URLs and potential leakage of sensitive data. To mitigate this risk, it is crucial to upgrade to Active Storage version 5.2.1.1 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for activestorage →
FAQ
Active Storage versions 5.2.0 to 5.2.1.0 are affected when using GCS or Disk services in production.
No, other storage services like S3 or Azure are not affected by this vulnerability.
By exploiting this vulnerability, an attacker can modify parameters to execute HTML files inline and gain access to private signed URLs within a specific storage path, potentially exposing sensitive information.
Yes, upgrading to Active Storage version 5.2.1.1 or later fixes this vulnerability.
No, there is no specific workaround available. It is recommended to upgrade to the fixed version of Active Storage.
Related vulnerabilities
Recent vulnerabilities recorded for activestorage.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
