PT-2026-27259 · Rails · Rails

Jean Boussier · Published 2026-03-23 · Updated 2026-03-24 · CVE-2026-33173

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Rails versions prior to 8.1.2.1 Rails versions prior to 8.0.4.1 Rails versions prior to 7.2.3.1

Description Active Storage in Rails applications allows users to attach files from cloud and local sources. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, the DirectUploadsController accepts arbitrary metadata from a client and stores it with the file. Internal flags, such as identified and analyzed, are stored within the same metadata. This allows a malicious client to manipulate these flags, bypassing MIME detection and analysis. An attacker can upload arbitrary content while falsely claiming a safe content type, circumventing validations that depend on Active Storage’s automatic content type identification. The DirectUploadsController is the component affected by this issue.

Recommendations Update to Rails version 8.1.2.1 or later. Update to Rails version 8.0.4.1 or later. Update to Rails version 7.2.3.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-925

Related Identifiers

CVE-2026-33173

GHSA-QCFX-2MFW-W4CG

Affected Products

Rails

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33173.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-33173.yml · Exploit
• https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0 · Patch
• https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e · Patch
• https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53 · Patch
• https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33173 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qcfx-2mfw-w4cg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33173 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-33173 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33173 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33173 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33173 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33173 · Security Note
• https://github.com/rails/rails · Note