CVE-2026-33195: Rails Active Storage Path Traversal Vulnerability
Summary
CVE-2026-33195: Rails Active Storage has possible Path Traversal in DiskService. Affects activestorage across 3 version ranges.
< 7.2.3.1
>= 8.0.0.beta1, < 8.0.4.1
>= 8.1.0.beta1, < 8.1.2.1
Fixed in 7.2.3.1, 8.0.4.1 or 8.1.2.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Active Storage is a component of the Ruby on Rails framework that facilitates file uploads and storage. It allows developers to manage file attachments in their applications seamlessly. However, a recent vulnerability has been identified in the DiskService component of Active Storage, which could potentially expose applications to security risks if not addressed promptly.
Vulnerability Detail
The vulnerability arises from the DiskService#path_for method, which fails to validate that the resolved filesystem path remains within the designated storage root directory. This oversight allows for path traversal attacks using blob keys that contain sequences like '../'. As a result, attackers could read, write, or delete arbitrary files on the server. Although blob keys are typically trusted strings, some applications may inadvertently pass user input as keys, making them susceptible to exploitation.
How To Fix
Latest published version: 8.1.4 as of 22 Oct 2026
gem install activestorage -v 8.1.4Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 7.2.3.17.2.3.1gem install activestorage -v 7.2.3.1 -
>= 8.0.0.beta1, < 8.0.4.18.0.4.1gem install activestorage -v 8.0.4.1 -
>= 8.1.0.beta1, < 8.1.2.18.1.2.1gem install activestorage -v 8.1.2.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that blob keys are sanitized and validated before being processed by the DiskService#path_for method. This can help mitigate the risk of path traversal attacks. For example, you can implement a validation check in your application code to restrict blob keys to a predefined format or set of characters.
Conclusion
The CVE-2026-33195 vulnerability in Rails Active Storage poses a significant risk due to its potential for path traversal attacks. It is essential for developers to update to the patched versions of the package and implement proper validation of blob keys to safeguard their applications.
See every vulnerability recorded for activestorage →
FAQ
The CVSS score of this vulnerability is 8.0, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The affected versions include Active Storage versions 8.1.0.beta1 to 8.1.2.1, 8.0.0.beta1 to 8.0.4.1, and all versions up to 7.2.3.1.
If immediate updates are not possible, implement input validation and sanitization for blob keys to reduce the risk of exploitation.
More information can be found in the advisory database at GitHub, specifically at the link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-9xrj-h377-fr87/GHSA-9xrj-h377-fr87.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for activestorage.
