Log in Start free

Vulnerability · Published Mar 23, 2026 · Assigned by GitHub_M

CVE-2026-33202Rails Active Storage has possible glob injection in its DiskService

Medium 6.6

In plain English

A medium-severity injection in activestorage from rails. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.6Medium
Exploit odds (30 days)0.7%top 47.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12rails2:6.1.7.10+dfsg-1~deb12u3DEBIAN-CVE-2026-33202
Debian:13rails2:7.2.2.2+dfsg-2~deb13u2DEBIAN-CVE-2026-33202
Debian:14rails2:7.2.3.1+dfsg-1DEBIAN-CVE-2026-33202
RubyGemsactivestorage8.1.2.1GHSA-73f9-jhhh-hr5m
RubyGemsactivestorage8.0.4.1GHSA-73f9-jhhh-hr5m
RubyGemsactivestorage7.2.3.1GHSA-73f9-jhhh-hr5m
Ubuntu:24.04:LTSrailsno fix listedUBUNTU-CVE-2026-33202
Ubuntu:25.10railsno fix listedUBUNTU-CVE-2026-33202
Ubuntu:26.04:LTSrailsno fix listedUBUNTU-CVE-2026-33202
Ubuntu:26.10railsno fix listedUBUNTU-CVE-2026-33202

Affected products (as reported)

VendorProductVersions
rails activestorage >= 8.1.0.beta1, < 8.1.2.1>= 8.0.0.beta1, < 8.0.4.1< 7.2.3.1

Weakness: CWE-74 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

References