PT-2026-27262 · Rails+1 · Rails+1

Mike Dalessio · Published 2026-03-23 · Updated 2026-05-08 · CVE-2026-33195

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rails versions prior to 8.1.2.1 Rails versions prior to 8.0.4.1 Rails versions prior to 7.2.3.1

Description Active Storage in Rails applications allows users to attach cloud and local files. The DiskService#path for function does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g., ../) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but applications passing user input as keys would be affected.

Recommendations Update to Rails version 8.1.2.1 or later. Update to Rails version 8.0.4.1 or later. Update to Rails version 7.2.3.1 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2026-07234

CVE-2026-33195

GHSA-9XRJ-H377-FR87

Affected Products

Rails

Red Os

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33195.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-33195.yml · Exploit
• https://github.com/rails/rails/commit/9b06fbc0f504b8afe333f33d19548f3b85fbe655 · Patch
• https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87 · Vendor Advisory
• https://github.com/rails/rails/commit/a290c8a1ec189d793aa6d7f2570b6a763f675348 · Patch
• https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c · Patch
• https://ubuntu.com/security/CVE-2026-33195 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33195 · Security Note
• https://osv.dev/vulnerability/GHSA-9xrj-h377-fr87 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33195 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33195 · Security Note
• https://bdu.fstec.ru/vul/2026-07234 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33195 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-33195 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33195 · Vendor Advisory