CVE-2026-33195
Rails Active Storage has possible Path Traversal in DiskService
Summary
Remediation
Upgrade to the fixed version using your package manager.
gem install activestorage -v 8.1.2.1
gem install activestorage -v 8.0.4.1
gem install activestorage -v 7.2.3.1
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (3)
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| activestorage | rubygems | 8.1.0, 8.1.0.beta1, 8.1.0.rc1, 8.1.1 (+1 more) | 8.1.2.1 |
| activestorage | rubygems | 8.0.0, 8.0.0.1, 8.0.0.beta1, 8.0.0.rc1 (+6 more) | 8.0.4.1 |
| activestorage | rubygems | 0.1, 5.2.0, 5.2.0.beta1, 5.2.0.beta2 (+157 more) | 7.2.3.1 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-22Path TraversalMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.1 score means for each attack dimension.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
References
- https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-33195ADVISORY
- https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2cWEB
- https://github.com/rails/rails/commit/9b06fbc0f504b8afe333f33d19548f3b85fbe655WEB
- https://github.com/rails/rails/commit/a290c8a1ec189d793aa6d7f2570b6a763f675348WEB
- https://github.com/rails/railsPACKAGE
- https://github.com/rails/rails/releases/tag/v7.2.3.1WEB
- https://github.com/rails/rails/releases/tag/v8.0.4.1WEB
- https://github.com/rails/rails/releases/tag/v8.1.2.1WEB
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-33195.ymlWEB
Frequently Asked Questions
- What is CVE-2026-33195?
- Rails Active Storage has possible Path Traversal in DiskService This vulnerability has been assigned a severity rating of HIGH (CVSS score: 9.1/10).
- How do I check if my project is affected by CVE-2026-33195?
- CVE-2026-33195 affects activestorage. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-33195 and 200,000+ other known vulnerabilities.
Severity & Exploitability
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
Related CVEs
- CVE-2025-24293CRITICAL
Active Storage allowed transformation methods that were potentially unsafe
- CVE-2022-21831CRITICAL
Possible code injection vulnerability in Rails / Active Storage
- CVE-2026-66066CRITICAL
Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing
- CVE-2026-33202MEDIUM
Rails Active Storage has possible glob injection in its DiskService
- CVE-2018-16477MEDIUM
Exposure of Sensitive Information to an Unauthorized Actor in activestorage
- CVE-2024-26144MEDIUM
Rails has possible Sensitive Session Information Leak in Active Storage
- CVE-2026-33173MEDIUM
Rails Active Storage has possible content type bypass via metadata in direct uploads
- CVE-2026-33174MEDIUM
Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies