CVE-2026-33173: Rails Active Storage has possible content type bypass via metadata in direct uploads
Impact Active Storage's DirectUploadsController accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like identified and analyzed are stored in the same metadata hash, a malicious direct-upload client could set these flags.
Releases The fixed releases are available at the normal locations.
Other sources
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, DirectUploadsController accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like identified and analyzed are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe contenttype, bypassing any validations that rely on Active Storage's automatic content type identification. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33173?
CVE-2026-33173 has been assigned a medium severity level due to potential risks associated with unauthorized metadata modification.
How do I fix CVE-2026-33173?
To fix CVE-2026-33173, upgrade Active Storage to version 7.2.3.1 or later, or to version 8.0.4.1 or later.
What types of software are affected by CVE-2026-33173?
CVE-2026-33173 affects the Active Storage component of Ruby on Rails, specifically certain versions before the fixed releases.
What are the risks associated with CVE-2026-33173?
The risks include unauthorized users being able to manipulate internal flags, leading to unauthorized behavior or data exposure.
Is there a workaround for CVE-2026-33173 if immediate patching is not possible?
Currently, there is no official workaround for CVE-2026-33173; upgrading to the latest versions is recommended.