CVE-2026-33173
Rails Active Storage has possible content type bypass via metadata in direct uploads
Summary
Remediation
Upgrade to the fixed version using your package manager.
gem install activestorage -v 8.1.2.1
gem install activestorage -v 8.0.4.1
gem install activestorage -v 7.2.3.1
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (3)
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| activestorage | rubygems | 8.1.0, 8.1.0.beta1, 8.1.0.rc1, 8.1.1 (+1 more) | 8.1.2.1 |
| activestorage | rubygems | 8.0.0, 8.0.0.1, 8.0.0.beta1, 8.0.0.rc1 (+6 more) | 8.0.4.1 |
| activestorage | rubygems | 0.1, 5.2.0, 5.2.0.beta1, 5.2.0.beta2 (+157 more) | 7.2.3.1 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-925
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 4.3 score means for each attack dimension.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cgWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-33173ADVISORY
- https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53WEB
- https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3eWEB
- https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0WEB
- https://github.com/rails/railsPACKAGE
- https://github.com/rails/rails/releases/tag/v7.2.3.1WEB
- https://github.com/rails/rails/releases/tag/v8.0.4.1WEB
- https://github.com/rails/rails/releases/tag/v8.1.2.1WEB
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-33173.ymlWEB
Frequently Asked Questions
- What is CVE-2026-33173?
- Rails Active Storage has possible content type bypass via metadata in direct uploads This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 4.3/10).
- How do I check if my project is affected by CVE-2026-33173?
- CVE-2026-33173 affects activestorage. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-33173 and 200,000+ other known vulnerabilities.
Severity & Exploitability
Exploitation requires specific conditions or has limited impact. Remediate within weeks.
Also Known As
Related CVEs
- CVE-2025-24293CRITICAL
Active Storage allowed transformation methods that were potentially unsafe
- CVE-2022-21831CRITICAL
Possible code injection vulnerability in Rails / Active Storage
- CVE-2026-66066CRITICAL
Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing
- CVE-2026-33202MEDIUM
Rails Active Storage has possible glob injection in its DiskService
- CVE-2018-16477MEDIUM
Exposure of Sensitive Information to an Unauthorized Actor in activestorage
- CVE-2024-26144MEDIUM
Rails has possible Sensitive Session Information Leak in Active Storage
- CVE-2026-33174MEDIUM
Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests
- CVE-2026-33658LOW
Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies