PT-2026-27263 · Rails+1 · Rails+1

Jhawthorn · Publicado 2026-03-23 · Atualizado 2026-05-08 · CVE-2026-33202

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rails versions prior to 8.1.2.1 Rails versions prior to 8.0.4.1 Rails versions prior to 7.2.3.1

Description Active Storage enables users to attach cloud and local files within Rails applications. A flaw exists in the DiskService#delete prefixed function where blob keys are passed directly to Dir.glob without proper escaping of glob metacharacters. This can lead to the deletion of unintended files from the storage directory if a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters.

Recommendations Update to Rails version 8.1.2.1 or later. Update to Rails version 8.0.4.1 or later. Update to Rails version 7.2.3.1 or later.

Exploit

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

BDU:2026-07240

CVE-2026-33202

GHSA-73F9-JHHH-HR5M

Produtos afetados

Rails

Red Os

Referências · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33202.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-33202.yml · Exploit
• https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m · Aviso do Fabricante
• https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82 · Correção
• https://github.com/rails/rails · Nota
• https://github.com/rails/rails/commit/8c9676b803820110548cdb7523800db43bc6874c · Correção
• https://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccf · Correção
• https://github.com/rails/rails/releases/tag/v7.2.3.1 · Nota
• https://github.com/rails/rails/releases/tag/v8.1.2.1 · Nota
• https://github.com/rails/rails/releases/tag/v8.0.4.1 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33202 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-33202 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-73f9-jhhh-hr5m · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33202 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-33202 · Aviso do Fabricante