PT-2026-27259 · Rails+1 · Active Storage

Published 2026-03-23 · Updated 2026-03-24 · CVE-2026-33173

NVD

CVSS v4.0

5.3

Medium

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, DirectUploadsController accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like identified and analyzed are stored in the same metadata hash, a direct-upload client can set these flags to skip MIME detection and analysis. This allows an attacker to upload arbitrary content while claiming a safe content type, bypassing any validations that rely on Active Storage's automatic content type identification. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

Fix

Weakness Enumeration

CWE-925

Related Identifiers

CVE-2026-33173

GHSA-QCFX-2MFW-W4CG

Affected Products

Active Storage

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-33173 · Security Note
• https://osv.dev/vulnerability/GHSA-qcfx-2mfw-w4cg · Vendor Advisory
• https://github.com/rails/rails · Note
• https://github.com/rails/rails/releases/tag/v8.0.4.1 · Note
• https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e · Note
• https://github.com/rails/rails/releases/tag/v7.2.3.1 · Note
• https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg · Note
• https://github.com/rails/rails/releases/tag/v8.1.2.1 · Note
• https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0 · Note
• https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53 · Note