CVE-2026-33195: Rails Active Storage has possible Path Traversal in DiskService
Impact Active Storage's DiskService#pathfor does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. ../) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected.
Releases The fixed releases are available at the normal locations.
Other sources
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's DiskService#pathfor does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. ../) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rubygems/activestorageto a version that resolves this vulnerability.Fixed in 7.2.3.1 - Upgrade
Upgrade
rubygems/activestorageto a version that resolves this vulnerability.Fixed in 8.0.4.1 - Upgrade
Upgrade
rubygems/activestorageto a version that resolves this vulnerability.Fixed in 8.1.2.1 - Upgrade
Upgrade
Rails Active Storage (DiskService#path_for)to a version that resolves this vulnerability.Fixed in 8.1.2.1 - Upgrade
Upgrade
Rails Active Storage (DiskService#path_for)to a version that resolves this vulnerability.Fixed in 8.0.4.1 - Upgrade
Upgrade
Rails Active Storage (DiskService#path_for)to a version that resolves this vulnerability.Fixed in 7.2.3.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33195?
The severity of CVE-2026-33195 is classified as high due to the potential for path traversal vulnerabilities.
How do I fix CVE-2026-33195?
To fix CVE-2026-33195, upgrade to Active Storage versions 7.2.3.1, 8.0.4.1, or 8.1.2.1 or later.
Which versions of Active Storage are affected by CVE-2026-33195?
Active Storage versions prior to 7.2.3.1, 8.0.4.1, and 8.1.2.1 are affected by CVE-2026-33195.
What causes CVE-2026-33195?
CVE-2026-33195 is caused by insufficient path validation in the DiskService's path_for method in Active Storage.
Is CVE-2026-33195 a common vulnerability?
CVE-2026-33195 is a specific vulnerability affecting Active Storage in Rails and may not be common across all applications.