PT-2026-27263 · Rails+1 · Rails+1

Jhawthorn · Published 2026-03-23 · Updated 2026-05-08 · CVE-2026-33202

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rails versions prior to 8.1.2.1 Rails versions prior to 8.0.4.1 Rails versions prior to 7.2.3.1

Description Active Storage enables users to attach cloud and local files within Rails applications. A flaw exists in the DiskService#delete prefixed function where blob keys are passed directly to Dir.glob without proper escaping of glob metacharacters. This can lead to the deletion of unintended files from the storage directory if a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters.

Recommendations Update to Rails version 8.1.2.1 or later. Update to Rails version 8.0.4.1 or later. Update to Rails version 7.2.3.1 or later.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

BDU:2026-07240

CVE-2026-33202

GHSA-73F9-JHHH-HR5M

Affected Products

Rails

Red Os

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33202.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-33202.yml · Exploit
• https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m · Vendor Advisory
• https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82 · Patch
• https://github.com/rails/rails/commit/8c9676b803820110548cdb7523800db43bc6874c · Patch
• https://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccf · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33202 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33202 · Security Note
• https://osv.dev/vulnerability/GHSA-73f9-jhhh-hr5m · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33202 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33202 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07240 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-33202 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33202 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33202 · Security Note