CVE-2026-33202: Rails Active Storage has possible glob injection in its DiskService
Impact Active Storage's DiskService#deleteprefixed passes blob keys directly to Dir.glob without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory.
Releases The fixed releases are available at the normal locations.
Other sources
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's DiskService#deleteprefixed passes blob keys directly to Dir.glob without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33202?
CVE-2026-33202 is classified as a moderate severity vulnerability due to the potential for glob injection in Active Storage's DiskService.
How do I fix CVE-2026-33202?
To mitigate CVE-2026-33202, update the Active Storage gem to version 7.2.3.1 or later, or 8.0.4.1 or 8.1.2.1.
What is affected by CVE-2026-33202?
CVE-2026-33202 affects the Rails Active Storage library specifically in versions prior to 7.2.3.1, 8.0.0 to 8.0.4.1, and 8.1.0 to 8.1.2.1.
What type of attack does CVE-2026-33202 enable?
CVE-2026-33202 enables glob injection attacks that could allow an attacker to manipulate file system commands.
Is there a known workaround for CVE-2026-33202 if I cannot upgrade?
Currently, there are no officially documented workarounds for CVE-2026-33202, so upgrading is the recommended course of action.